What’s Vulnerable › Vulnerabilities
CVE-2026-41013: Tenant-controlled comma smuggles arbitrary CIFS mount options
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-01 · updated 2026-07-22
- Weakness: CWE-88
Description
Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount options via bypassing the mount-option allowlist, enabling privilege escalation and security control bypass on multi-tenant Diego cells. Affected versions: smb-volume-release: All versions prior to v3.60.0 CF Deployment: All versions prior to v56.0.0
Affected products
- Cloud Foundry CF Deployment: before 56.0.0 — fixed in 56.0.0
- CloudFoundry Foundation smb-volume-release: before 3.60.0 — fixed in 3.60.0
How to fix
Upgrade to a fixed version: Cloud Foundry CF Deployment 56.0.0; CloudFoundry Foundation smb-volume-release 3.60.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-41013 or the next vulnerability affects your stack