Vulnerability · Published Jun 1, 2026 · Assigned by vmware
CVE-2026-41013Tenant-controlled comma smuggles arbitrary CIFS mount options
High 8.1
In plain English
A high-severity argument injection in CF Deployment from CloudFoundry Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount options via bypassing the mount-option allowlist, enabling privilege escalation and security control bypass on multi-tenant Diego cells. Affected versions: smb-volume-release: All versions prior to v3.60.0 CF Deployment: All versions prior to v56.0.0
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CloudFoundry Foundation | smb-volume-release | 0 – before 3.60.0 |
| CloudFoundry Foundation | CF Deployment | 0 – before 56.0.0 |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N