CVE-2026-59386
Medium · 6.5CVSS
6.5
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63339 IXP Manager is a full-stack web application for managing Internet Exchange Points. CWE-269
- CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. CWE-269
- CVE-2026-61850 Kargo manages and automates the promotion of software artifacts. CWE-269
- CVE-2026-118205 The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for… CWE-269
- CVE-2026-105894 The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine… CWE-269
- CVE-2026-101213 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege… CWE-269
- CVE-2026-113616 The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset… CWE-269
- CVE-2026-86393 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024… CWE-269