Cloud FOundry
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| CF Deployment | 16 | – | Oct 30, 2026 |
| UAA | 7 | – | Oct 30, 2026 |
| Routing | 4 | – | Sep 8, 2023 |
| CAPI | 4 | – | Dec 2, 2020 |
| Routing Release | 2 | – | Jun 10, 2024 |
| Cloud Foundry | 1 | – | Nov 11, 2024 |
| Cloud Foundry Controller (CAPI) | 1 | – | Oct 30, 2026 |
| Cloud Foundry UAA | 1 | – | Jan 31, 2025 |
| CredHub | 1 | – | Feb 12, 2020 |
| haproxy-boshrelease | 1 | – | Jul 3, 2024 |
| Notifications | 1 | – | Jun 16, 2023 |
| SMB-volume release | 1 | – | Jun 16, 2023 |
| BOSH System Metrics Server | 1 | – | Oct 2, 2020 |
| UUA | 1 | – | Apr 16, 2026 |
| bosh-vsphere-cpi-release | 1 | – | Aug 29, 2026 |
| CAPI (Cloud Controller API) | 1 | – | Oct 30, 2026 |
| CAPI (Cloud Foundry Controller) | 1 | – | Oct 30, 2026 |
| cf-nfs-volume release | 1 | – | Jun 16, 2023 |
Exploited and recent CVEs
- CVE-2026-59387 Broken access control restriction in Cloud Controller API 0.2%
- CVE-2026-59387 Broken access control restriction in Cloud Controller API 0.2%
- CVE-2026-59385 Space Developer can extract space-scoped broker credentials 0.2%
- CVE-2026-59385 Space Developer can extract space-scoped broker credentials 0.2%
- CVE-2026-59386 Credential exposure to space supporter 0.2%
- CVE-2026-59386 Credential exposure to space supporter 0.2%
- CVE-2026-59396 DoS Vulnerability in UAA Related to JWKS URI Handling 0.3%
- CVE-2026-59396 DoS Vulnerability in UAA Related to JWKS URI Handling 0.3%
- CVE-2026-59357 Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions 0.2%
- CVE-2026-59357 Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions 0.2%
- CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type 0.4%
- CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type 0.4%
- CVE-2026-41012 BOSH vSphere CPI Improper Cert Validation 0.1%
- CVE-2026-59335 Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise 0.5%
- CVE-2026-59335 Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise 0.5%
- CVE-2026-41005 UAA accepts SAML Encrypted Assertions authentication bypass 0.1%
- CVE-2026-41005 UAA accepts SAML Encrypted Assertions authentication bypass 0.1%
- CVE-2026-22734 Cloud Foundry UAA SAML 2.0 Signature Bypass 0.4%
- CVE-2025-22246 CVE-2025-22246 – UAA Private Key Exposure 0.2%
- CVE-2025-22246 CVE-2025-22246 – UAA Private Key Exposure 0.2%
- CVE-2025-22216 CVE-2025-22216 UAA Missing Zone Validation 0.2%
- CVE-2024-38826 CVE-2024-38826 Cloud Controller Denial of Service Attack 0.4%
- CVE-2024-37082 When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry a 0.5%
- CVE-2024-22279 GoRouter Denial of Service Attack 0.4%
- CVE-2023-34061 CVE-2023-34061 – Gorouter route pruning 0.5%
- CVE-2023-34061 CVE-2023-34061 – Gorouter route pruning 0.5%
- CVE-2023-34041 CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter 0.4%
- CVE-2023-34041 CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter 0.4%
- CVE-2023-20885 CF workflows leak credentials in system audit logs 0.5%
- CVE-2023-20885 CF workflows leak credentials in system audit logs 0.5%