Cloudfoundry vulnerabilities

Products

• Cf-deployment 37
• Cf-release 35
• Cloud Foundry 23
• Capi-release 22
• Cloud Foundry Uaa Bosh 15
• User Account And Authentication 9
• Routing-release 8
• Routing Release 5
• Uaa Release 5
• Bosh Cli 4
• Uaa-release 3
• Container Runtime 2
• Credhub 2
• Garden-runc 2
• Loggregator 2
• Stratos 2

Newest

• bosh-ecosystem / bosh (bosh-cli) bosh-cli, cloudfoundry bosh cli +1 more Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director CVE-2026-47829 7.7 HighJuly 9, 2026
• bosh-ecosystem / bosh (bosh-cli) bosh-cli, cloudfoundry bosh cli +1 more Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay CVE-2026-47828 8.9 HighJuly 9, 2026
• cloudfoundry bosh cli, cloudfoundry foundation bosh cli tool +1 more blobs.yaml Path Traversal Allows File Writes CVE-2026-47826 8.5 HighJuly 9, 2026
• cloudfoundry bosh cli BOSH CLI Shell Injection CVE-2026-41857 7.1 HighJuly 9, 2026
• cloudfoundry routing release, cloudfoundry foundation cf deployment, cloudfoundry cf-deployment +2 more Route Services Firewall Bypass CVE-2026-22726 5.0 MediumApril 30, 2026
• cloudfoundry cloud foundry Cloud Foundry unprotected internal endpoints CVE-2026-22727 7.5 HighMarch 17, 2026
• cloudfoundry foundation uaa, cloudfoundry cf-deployment, uaa-release +2 more UAA User Token Revocation logic error CVE-2026-22723 Fix available 6.5 MediumMarch 5, 2026
• cloud foundry uaa, cloudfoundry uaa release, cloud foundry cf deployment +1 more +3 more CVE-2025-22246 – UAA Private Key Exposure CVE-2025-22246 3.0 LowMay 13, 2025
• cloud foundry foundry, cloudfoundry cloud foundry +1 more CVE-2024-38826 Cloud Controller Denial of Service Attack CVE-2024-38826 5.3 MediumNovember 11, 2024
• cloud foundry haproxy-boshrelease Security check loophole in HAProxy release (in combination with routing release) in Cloud Foundry... CVE-2024-37082 9.1 CriticalJuly 3, 2024
• cloud foundry routing release, cloudfoundry cf-deployment +1 more GoRouter Denial of Service Attack CVE-2024-22279 5.9 MediumJune 10, 2024
• cloud foundry routing, cf deployment, cloudfoundry cf-deployment +1 more +3 more CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter CVE-2023-34041 5.3 MediumSeptember 8, 2023
• cloudfoundry routing release, cf-deployment +1 more In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter... CVE-2023-20882 5.9 MediumMay 26, 2023
• cloudfoundry loggregator-agent, capi-release, cf-deployment +2 more Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator... CVE-2023-20881 8.1 HighMay 19, 2023
• cloudfoundry cloud foundry, user account and authentication +1 more This disclosure regards a vulnerability related to UAA refresh tokens and external identity... CVE-2023-20903 4.3 MediumMarch 28, 2023
• cloudfoundry diego, cf-deployment +1 more Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up... CVE-2022-31733 9.1 CriticalFebruary 3, 2023
• cloudfoundry capi-release, cf-deployment +1 more In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer... CVE-2021-22100 5.3 MediumMarch 25, 2022
• cloudfoundry capi-release, cf-deployment +1 more Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service... CVE-2021-22101 7.5 HighOctober 27, 2021
• cloudfoundry cf-deployment, user account and authentication +1 more UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious... CVE-2021-22098 6.1 MediumAugust 11, 2021
• cloudfoundry cf-deployment, user account and authentication +1 more In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was... CVE-2021-22001 7.5 HighJuly 22, 2021
• cloudfoundry archiver, code.cloudfoundry.org/archiver code.cloudfoundry.org/archiver/extractor +1 more Path traversal in code.cloudfoundry.org/archiver CVE-2018-25046 Fix available 9.1 CriticalApril 14, 2021
• cloudfoundry capi-release, cf-deployment +1 more Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default... CVE-2021-22115 6.5 MediumApril 8, 2021
• cloud foundry capi, cf deployment, cloudfoundry capi-release +1 more +3 more Cloud Controller is vulnerable to denial of service via YAML parsing CVE-2020-5423 7.5 HighDecember 2, 2020
• cloud foundry routing, cloudfoundry gorouter, cloud foundry cf deployment +1 more +3 more Gorouter is vulnerable to DoS attack via invalid HTTP responses CVE-2020-5420 7.7 HighSeptember 3, 2020
• cloud foundry capi, cf deployment, cloudfoundry capi-release +1 more +3 more Cloud Controller allows users with no roles to list droplets CVE-2020-5418 3.1 LowSeptember 3, 2020
• cloud foundry capi, cf deployment, cloudfoundry capi-release +1 more +3 more Cloud Controller may allow developers to claim sensitive routes CVE-2020-5417 8.5 HighAugust 21, 2020
• cloud foundry routing, cf deployment, cloudfoundry cf-deployment +1 more +3 more CF clusters with NGINX in front of them may be vulnerable to DoS CVE-2020-5416 7.7 HighAugust 21, 2020
• golang go, cloudfoundry cf-deployment, routing-release +3 more +5 more Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as... CVE-2020-15586 Fix available 5.9 MediumJuly 17, 2020
• cloud foundry uaa, cloudfoundry cf-deployment, user account and authentication +2 more UAA fails to check the state parameter when authenticating with external IDPs CVE-2020-5402 8.8 HighFebruary 27, 2020
• cloud foundry routing, cloudfoundry routing release +1 more Cloud Foundry GoRouter is vulnerable to cache poisoning CVE-2020-5401 5.3 MediumFebruary 27, 2020
• cloud foundry capi, cloudfoundry capi-release, cf-deployment +2 more Cloud Controller logs environment variables from app manifests CVE-2020-5400 8.0 HighFebruary 27, 2020
• cloud foundry credhub, pivotal software cloud foundry cf-deployment +1 more CredHub does not properly enable TLS for MySQL database connections CVE-2020-5399 7.6 HighFebruary 12, 2020
• cloud foundry capi, cloudfoundry capi-release, cf-deployment +2 more CAPI leaks service broker URLs and GUIDs to space developers CVE-2019-11294 4.3 MediumDecember 19, 2019
• cloud foundry uaa release, cloudfoundry cf-deployment, user account and authentication +2 more UAA logs all query parameters with debug logging level CVE-2019-11293 8.8 HighDecember 6, 2019
• cloud foundry uaa release, cloudfoundry cf-deployment, user account and authentication +2 more Cloud Foundry UAA logs query parameters in tomcat access file CVE-2019-11290 8.8 HighNovember 25, 2019
• cloud foundry routing, cloudfoundry cf-deployment, routing-release +2 more A forged route service request using an invalid nonce can cause the gorouter to panic and crash CVE-2019-11289 Fix available 8.6 HighNovember 19, 2019
• cloud foundry smb volume, pivotal software cloud foundry smb volume, cloud foundry cf deployment +1 more +3 more Password leak in smbdriver logs CVE-2019-11283 8.8 HighOctober 23, 2019
• pivotal software cloud foundry uaa, cloud foundry cf deployment, uaa release +1 more +3 more UAA is vulnerable to a Blind SCIM injection leading to information disclosure CVE-2019-11282 4.3 MediumOctober 23, 2019
• cloud foundry uaa release (oss), cloudfoundry uaa release +1 more Privilege Escalation via Scope Manipulation in UAA CVE-2019-11279 8.7 HighSeptember 26, 2019
• cloud foundry uaa release (oss), cloudfoundry user account and authentication +1 more Privilege Escalation via Blind SCIM Injection in UAA CVE-2019-11278 8.7 HighSeptember 26, 2019
• cloud foundry cf deployment, cf nfs volume release, cloudfoundry cf-deployment +1 more +3 more Volume Services is vulnerable to an LDAP injection attack CVE-2019-11277 8.4 HighSeptember 23, 2019
• cloud foundry uaa release (oss), cloudfoundry user account and authentication +1 more UAA SCIM Filter XSS CVE-2019-11274 4.3 MediumAugust 9, 2019
• cloud foundry cf-deployment, credhub, uaa release (oss) +2 more +4 more Java Projects using HTTP to fetch dependencies CVE-2019-3801 8.7 HighApril 25, 2019
• cloudfoundry uaa release, cloud foundry uaa release (oss), pivotal application service +2 more UAA redirect-uri allows wildcard in the subdomain CVE-2019-3788 8.7 HighApril 25, 2019
• cloudfoundry routing release, cloud foundry cf routing +1 more Gorouter allows space developer to hijack route services hosted outside the platform CVE-2019-3789 8.8 HighApril 24, 2019
• cloud foundry bosh backup and restore BBR could run arbitrary scripts on deployment VMs CVE-2019-3786 7.7 HighApril 24, 2019
• cloud foundry capi-release Escalation of Privileges in Cloud Controller CVE-2019-3798 6.0 MediumApril 17, 2019
• cloud foundry capi, cloudfoundry capi-release +1 more Cloud Controller provides signed URL with write authorization to read only user CVE-2019-3785 6.5 MediumMarch 13, 2019
• cloudfoundry container runtime, cloud foundry container runtime (cfcr) +1 more Cloud Foundry Container Runtime Leaks IAAS Credentials CVE-2019-3780 9.1 CriticalMarch 8, 2019
• cloudfoundry container runtime, cloud foundry container runtime (cfcr) +1 more Cloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCD CVE-2019-3779 8.8 HighMarch 8, 2019
• Show olderLoading…