A Cloud Foundry user possessing the SpaceDeveloper role can alter the URL of a space‑scoped service broker while leaving its stored credentials untouched. Because the Cloud Foundry API does not allow direct reading of broker credentials, the attacker can redirect traffic from the original broker to an attacker‑controlled broker, thereby enabling the extraction of the existing broker credentials. This flaw primarily threatens the confidentiality of the broker credentials; it does not grant the attacker immediate access to services bound to the broker, but based on the description it is inferred that the extracted credentials could be reused to impersonate the broker and potentially reach resources protected by those credentials.

The vulnerability affects Cloud Foundry Cloud Foundry Controller (CAPI) and Cloud Foundry CF Deployment components. No specific product versions are mentioned in the data.

The CVSS score of 2.7 classifies this as low severity. The EPSS score is not available, so the historical probability of exploitation is unknown. The CVE is not listed in the CISA KEV catalog. The most likely attack vector is a local attack within a Cloud Foundry space carried out by an authorized SpaceDeveloper. The risk is limited to the exposure of broker credentials, which could be leveraged for further attacks if the attacker is able to reuse them to impersonate the broker.