CVE-2026-41013CWE-88

Tenant-controlled comma smuggles arbitrary CIFS mount options

High · published June 1, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount options via bypassing the mount-option allowlist, enabling privilege escalation and security control bypass on multi-tenant Diego cells.

Affected versions:

smb-volume-release: All versions prior to v3.60.0

CF Deployment: All versions prior to v56.0.0

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00416 · 34.8th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-06-01T17:36Z
EPSS history
Timeline
  • 01 JUN 17:36Z
    Tenant-controlled comma smuggles arbitrary CIFS mount options
    cvelistv5