CVE-2026-47833

Name of the Vulnerable Software and Affected Versions bpm-release versions prior to v1.4.30

Description A container-to-host privilege escalation exists where the setupBpmLogs function follows symlinks for bpm.log during open and chown operations. A compromised process within a bpm container can force the root user to change the ownership of an arbitrary host file to the vcap user and append bpm JSON log lines to it. By utilizing this mechanism, an attacker can take ownership of /etc/shadow and read password hashes on the host through the read-only /etc bind mount, resulting in a confidentiality breach for all bpm-managed jobs.

Recommendations Update to version v1.4.30 or later.