The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-59387 reveals a critical access control vulnerability in Cloud Controller's Nginx routing configuration. The security team implemented OAuth and mutual TLS protections for /internal/v4/ and /internal/v5/ endpoints, but failed to apply equivalent deny rules to the /internal/v3/ path. This oversight exposes staging callback endpoints that are designed for internal use only—specifically the droplet_completed and build_completed handlers—to unauthenticated requests from the public API listener. An attacker who can obtain or predict valid build or droplet GUIDs can forge staging callbacks to manipulate application state, potentially completing builds prematurely, corrupting deployments, or triggering unauthorized resource provisioning. This affects any organization running vulnerable Cloud Controller instances that rely on these internal endpoints for application lifecycle management.
While MITRE ATT&CK techniques aren't formally mapped to this configuration flaw, Casky's security skills would detect the attack patterns through analysis of T1190 (Exploit Public-Facing Application) and T1021 (Remote Services) by identifying anomalous callback submissions to internal endpoints from external sources. Practitioners using Casky would see findings highlighting: (1) HTTP requests to /internal/v3/ paths lacking expected OAuth tokens or certificate validation, (2) staging callback submissions with mismatched or suspicious GUID patterns, (3) state transitions occurring outside normal build pipelines, and (4) timing anomalies suggesting forged rather than legitimate staging events. The extended reasoning capability would correlate these signals to surface the root cause—missing access control rules—and recommend implementing deny rules for /internal/v3/ parity with v4/v5, validating callback authenticity cryptographically, and monitoring for unauthorized state transitions in application deployments.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-59387. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation