Technical impact
Input validation bypass in the SMB volume mount handling of CloudFoundry Diego releases allows a low‑privileged space developer to inject arbitrary kernel CIFS mount options by bypassing the mount‑option allowlist. The injected options give the attacker elevated privileges and enable bypass of security controls on multi‑tenant Diego cells. This weakness is classified as CWE‑88. The result is that a tenant can compromise other tenants or the host kernel, leading to loss of confidentiality, integrity and availability.
Affected Systems
The flaw exists in all releases of SMB volume release earlier than version 3.60.0 and in all CF Deployment releases earlier than version 56.0.0 from the CloudFoundry Foundation. Systems using these older versions are vulnerable.
Risk and Exploitability
The CVSS score of 8.1 indicates high severity for this vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a tenant who has developer role permissions and can mount SMB volumes within their space; no additional user interaction or remote code execution is required. Exploiting the flaw requires only configuration of mount options and will succeed on all Diego cells that run an affected version of the SMB volume release.
