CVE-2026-47833 Details
Description
setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container can cause root to chown an arbitrary host file to vcap and append bpm JSON log lines to it. The chown alone lets the attacker take ownership of /etc/shadow and read every password hash on the host via the read-only /etc bind mount. This is a container-to-host confidentiality break affecting every bpm-managed job. Affected versions: bpm-release, all versions prior to v1.4.30.
A symlink vulnerability has been identified in the Cloud Foundry BPM release, all versions prior to v1.4.30. This vulnerability allows container-to-host privilege escalation by exploiting the setupBpmLogs function, which follows symlinks for the bpm.log file. A compromised process within a BPM container can manipulate root to change the ownership of an arbitrary host file to the vcap user and append BPM JSON log lines to it. This unauthorized chown action enables the attacker to take ownership of the /etc/shadow file and access all password hashes on the host through the read-only /etc bind mount. Consequently, this vulnerability creates a confidentiality breach from the container to the host, impacting all jobs managed by BPM.
Users are advised to upgrade to Cloud Foundry BPM release versions v1.4.30 or greater.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cloudfoundry.org/blog/cve-2026-47833-symlink-vulnerability-in-setupbpmlogs-allows-container-to-host-privilege-escalation-via-etc-shadow/ | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |