Cloud Foundry
72 CVEs across 41 Cloud Foundry products. Browse Cloud Foundry vulnerabilities, severities, and proof-of-concept exploits.
Cloud Foundry products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41005 | Critical | 9.0 | 2026-06-11 | Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (a… |
CVE-2026-22734 | High | 8.6 | 2026-04-17 | Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability… |
CVE-2025-22246 | Low | 3.0 | 2025-05-13 | Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. |
CVE-2025-22216 | Medium | 5.4 | 2025-01-31 | A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP… |
CVE-2024-38826 | | 2024-11-11 | Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack aga… | |
CVE-2024-37082 | Critical | 9.1 | 2024-07-03 | When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypa… |
CVE-2024-22279 | Medium | 5.9 | 2024-06-10 | Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Clou… |
CVE-2023-34061 | High | 7.5 | 2024-01-12 | Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to for… |
CVE-2023-34041 | Medium | 5.3 | 2023-09-08 | Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerabil… |
CVE-2023-20885 | Medium | 6.5 | 2023-06-16 | Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versi… |
CVE-2020-5423 | High | 7.5 | 2020-12-02 | CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send speciall… |
CVE-2020-5422 | Medium | 6.5 | 2020-10-02 | BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any… |
CVE-2020-5420 | High | 7.7 | 2020-09-03 | Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pu… |
CVE-2020-5418 | Medium | 4.3 | 2020-09-03 | Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spa… |
CVE-2020-5417 | High | 8.8 | 2020-08-21 | Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the… |
CVE-2020-5416 | Medium | 6.5 | 2020-08-21 | Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vul… |
CVE-2020-5402 | High | 8.8 | 2020-02-27 | In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when… |
CVE-2020-5401 | Medium | 5.3 | 2020-02-27 | Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to… |
CVE-2020-5400 | Medium | 6.5 | 2020-02-27 | Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information… |
CVE-2020-5399 | High | 7.4 | 2020-02-12 | Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the… |
CVE-2019-11294 | Medium | 4.3 | 2019-12-19 | Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs… |
CVE-2019-11293 | Medium | 6.5 | 2019-12-06 | Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote… |
CVE-2019-11290 | High | 7.5 | 2019-11-26 | Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentica… |
CVE-2019-11289 | High | 8.6 | 2019-11-19 | Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route s… |
CVE-2019-11283 | High | 8.8 | 2019-10-23 | Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs ca… |
CVE-2019-11282 | Medium | 4.3 | 2019-10-23 | Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim… |
CVE-2019-11279 | High | 8.8 | 2019-09-26 | CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user c… |
CVE-2019-11278 | High | 8.8 | 2019-09-26 | CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft… |
CVE-2019-11277 | High | 8.1 | 2019-09-23 | Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malic… |
CVE-2019-11274 | Medium | 6.1 | 2019-08-09 | Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM… |
CVE-2019-3800 | Medium | 6.3 | 2019-08-05 | CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-cred… |
CVE-2019-11270 | High | 7.5 | 2019-08-05 | Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the r… |
CVE-2019-3794 | Medium | 5.4 | 2019-07-18 | Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UA… |
CVE-2019-11268 | Medium | 4.3 | 2019-07-11 | Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for on… |
CVE-2019-3787 | High | 8.3 | 2019-06-19 | Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does no… |
CVE-2019-11271 | High | 7.8 | 2019-06-19 | Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database… |
CVE-2019-3801 | Critical | 9.8 | 2019-04-25 | Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote… |
CVE-2019-3788 | High | 8.7 | 2019-04-25 | Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wild… |
CVE-2019-3789 | Medium | 6.5 | 2019-04-24 | Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platfor… |
CVE-2019-3786 | High | 7.1 | 2019-04-24 | Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malic… |
CVE-2019-3798 | Medium | 6.0 | 2019-04-17 | Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated… |
CVE-2019-3785 | High | 8.1 | 2019-03-13 | Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read perm… |
CVE-2019-3780 | High | 8.8 | 2019-03-08 | Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user… |
CVE-2019-3779 | High | 8.8 | 2019-03-08 | Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for… |
CVE-2019-3784 | High | 8.2 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using… |
CVE-2019-3783 | High | 8.8 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brut… |
CVE-2019-3781 | High | 8.8 | 2019-03-07 | Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authent… |
CVE-2019-3775 | High | 7.1 | 2019-03-07 | Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by ch… |
CVE-2019-3782 | High | 7.8 | 2019-02-13 | Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config… |
CVE-2018-15754 | Medium | 4.2 | 2018-12-13 | Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts acro… |
CVE-2018-15800 | High | 8.1 | 2018-12-10 | Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to… |
CVE-2018-15797 | High | 8.4 | 2018-12-05 | Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nf… |
CVE-2018-15761 | Critical | 9.9 | 2018-11-19 | Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A rem… |
CVE-2018-15796 | High | 8.1 | 2018-11-09 | Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL… |
CVE-2018-15755 | Medium | 6.6 | 2018-10-12 | Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the… |
CVE-2018-1264 | Critical | 9.1 | 2018-10-05 | Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained acces… |
CVE-2018-11083 | High | 8.1 | 2018-10-05 | Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to… |
CVE-2018-11082 | Medium | 6.6 | 2018-10-05 | Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthen… |
CVE-2018-11084 | Medium | 6.8 | 2018-09-18 | Cloud Foundry Garden-runC release, versions prior to 1.16.1, prevents deletion of some app environments based on file attributes. A remote authenticated malici… |
CVE-2018-1223 | High | 8.8 | 2018-09-17 | Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs. A malicious user with the a… |
CVE-2018-11047 | High | 7.5 | 2018-07-24 | Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly a… |
CVE-2016-0708 | Medium | 5.9 | 2018-07-11 | Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to envi… |
CVE-2018-11041 | Medium | 6.1 | 2018-06-25 | Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1… |
CVE-2018-1269 | Medium | 6.5 | 2018-06-06 | Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not ha… |
CVE-2018-1268 | Medium | 6.8 | 2018-06-06 | Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not va… |
CVE-2018-1265 | High | 7.2 | 2018-06-06 | Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privi… |
CVE-2018-1193 | Medium | 5.3 | 2018-05-23 | Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded… |
CVE-2018-1276 | Medium | 6.5 | 2018-05-17 | Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere. A remote user with the ability to push apps can… |
CVE-2018-1262 | High | 7.2 | 2018-05-15 | Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients perform… |
CVE-2018-1277 | Medium | 6.5 | 2018-04-30 | Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. A remote authenticated user may push an ap… |
CVE-2016-2169 | Medium | 5.3 | 2018-04-18 | Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application devel… |
CVE-2018-1191 | High | 8.8 | 2018-03-29 | Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain le… |