Cloudfoundry Foundation vulnerabilities

Products

• Cf Deployment 17
• Uaa 13
• Routing Release 3

Newest

• cloud foundry capi (cloud foundry controller), cf deployment +1 more Space Developer can extract space-scoped broker credentials CVE-2026-59385 2.7 LowOctober 30, 2026
• cloud foundry uaa, cf-deployment +1 more DoS Vulnerability in UAA Related to JWKS URI Handling CVE-2026-59396 6.9 MediumOctober 30, 2026
• cloud foundry uaa, cf-deployment +1 more Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions CVE-2026-59357 6.5 MediumOctober 6, 2026
• cloud foundry uaa, cf-deployment +1 more UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type CVE-2026-59358 Public exploit 7.6 HighOctober 6, 2026
• cloud foundry foundation uaa, cloud foundry cf-deployment +1 more Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin CVE-2026-47839 9.2 CriticalSeptember 11, 2026
• cloud foundry uaa, cf-deployment +1 more Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise CVE-2026-59335 8.7 HighAugust 25, 2026
• cloud foundry bosh Arbitrary Root File Write via Path Traversal in BOSH agent CVE-2026-41861 4.2 MediumAugust 6, 2026
• cloud foundry cf-deployment, cloudfoundry foundation uaa +1 more LDAP StartTLS unconditionally disables hostname verification CVE-2026-47840 8.3 HighJuly 9, 2026
• bosh-ecosystem / bosh (bosh-cli) bosh-cli, cloudfoundry bosh cli +1 more Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director CVE-2026-47829 7.7 HighJuly 9, 2026
• cloudfoundry bosh cli, cloudfoundry foundation bosh cli tool +1 more blobs.yaml Path Traversal Allows File Writes CVE-2026-47826 8.5 HighJuly 9, 2026
• cloud foundry cf deployment, uaa +1 more UAA accepts SAML Encrypted Assertions authentication bypass CVE-2026-41005 9.0 CriticalJune 11, 2026
• cloud foundry foundation cf deployment, uaa release +1 more Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure.... CVE-2026-40965 10.0 CriticalJune 1, 2026
• cloud foundry foundation cf deployment, log-cache release +1 more Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an... CVE-2026-40964 7.5 HighJune 1, 2026
• cloudfoundry foundation cf deployment, smb-volume-release +1 more Tenant-controlled comma smuggles arbitrary CIFS mount options CVE-2026-41013 8.1 HighJune 1, 2026
• cloudfoundry routing release, cloudfoundry foundation cf deployment, cloudfoundry cf-deployment +2 more Route Services Firewall Bypass CVE-2026-22726 5.0 MediumApril 30, 2026
• cloudfoundry foundation uaa, cloudfoundry cf-deployment, uaa-release +2 more UAA User Token Revocation logic error CVE-2026-22723 Fix available 6.5 MediumMarch 5, 2026
• cloud foundry uaa, cloudfoundry uaa release, cloud foundry cf deployment +1 more +3 more CVE-2025-22246 – UAA Private Key Exposure CVE-2025-22246 3.0 LowMay 13, 2025
• cloudfoundry foundation uaa UAA Failure to Remove Shadow User’s Access CVE-2024-38806 3.9 LowJuly 18, 2024
• cloud foundry routing release, cloudfoundry cf-deployment +1 more GoRouter Denial of Service Attack CVE-2024-22279 5.9 MediumJune 10, 2024
• cloud foundry routing release, pivotal cloud foundry deployment, cloud foundry routing release +1 more +3 more CVE-2023-34061 – Gorouter route pruning CVE-2023-34061 7.5 HighJanuary 12, 2024
• cloud foundry routing, cf deployment, cloudfoundry cf-deployment +1 more +3 more CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter CVE-2023-34041 5.3 MediumSeptember 8, 2023
• cloud foundry capi, cf deployment, cloudfoundry capi-release +1 more +3 more Cloud Controller is vulnerable to denial of service via YAML parsing CVE-2020-5423 7.5 HighDecember 2, 2020
• cloud foundry routing, cloudfoundry gorouter, cloud foundry cf deployment +1 more +3 more Gorouter is vulnerable to DoS attack via invalid HTTP responses CVE-2020-5420 7.7 HighSeptember 3, 2020
• cloud foundry capi, cf deployment, cloudfoundry capi-release +1 more +3 more Cloud Controller allows users with no roles to list droplets CVE-2020-5418 3.1 LowSeptember 3, 2020
• cloud foundry capi, cf deployment, cloudfoundry capi-release +1 more +3 more Cloud Controller may allow developers to claim sensitive routes CVE-2020-5417 8.5 HighAugust 21, 2020
• cloud foundry routing, cf deployment, cloudfoundry cf-deployment +1 more +3 more CF clusters with NGINX in front of them may be vulnerable to DoS CVE-2020-5416 7.7 HighAugust 21, 2020
• cloud foundry uaa, cloudfoundry cf-deployment, user account and authentication +2 more UAA fails to check the state parameter when authenticating with external IDPs CVE-2020-5402 8.8 HighFebruary 27, 2020
• cloud foundry smb volume, pivotal software cloud foundry smb volume, cloud foundry cf deployment +1 more +3 more Password leak in smbdriver logs CVE-2019-11283 8.8 HighOctober 23, 2019
• pivotal software cloud foundry uaa, cloud foundry cf deployment, uaa release +1 more +3 more UAA is vulnerable to a Blind SCIM injection leading to information disclosure CVE-2019-11282 4.3 MediumOctober 23, 2019
• cloud foundry cf deployment, cf nfs volume release, cloudfoundry cf-deployment +1 more +3 more Volume Services is vulnerable to an LDAP injection attack CVE-2019-11277 8.4 HighSeptember 23, 2019
• cloud foundry uaa, uaa release, pivotal software cloud foundry uaa +1 more +3 more UAA Privilege Escalation CVE-2018-15761 Fix available 9.9 CriticalNovember 19, 2018
• cloud foundry uaa, uaa release, pivotal software cloudfoundry uaa +1 more +3 more Cloud Foundry UAA MFA does not prevent brute force of MFA code CVE-2018-11082 6.6 MediumOctober 5, 2018