Cloud Foundry Cf Deployment
12 CVEs affecting Cloud Foundry Cf Deployment. Latest disclosed: 2026-06-11. Critical: 1, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41005 | Critical | 9.0 | 2026-06-11 | Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (a… |
CVE-2020-5417 | High | 8.8 | 2020-08-21 | Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the… |
CVE-2019-11283 | High | 8.8 | 2019-10-23 | Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs ca… |
CVE-2019-11277 | High | 8.1 | 2019-09-23 | Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malic… |
CVE-2020-5420 | High | 7.7 | 2020-09-03 | Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pu… |
CVE-2023-34061 | High | 7.5 | 2024-01-12 | Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to for… |
CVE-2020-5423 | High | 7.5 | 2020-12-02 | CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send speciall… |
CVE-2020-5416 | Medium | 6.5 | 2020-08-21 | Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vul… |
CVE-2023-34041 | Medium | 5.3 | 2023-09-08 | Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerabil… |
CVE-2020-5418 | Medium | 4.3 | 2020-09-03 | Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spa… |
CVE-2019-11282 | Medium | 4.3 | 2019-10-23 | Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim… |
CVE-2025-22246 | Low | 3.0 | 2025-05-13 | Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. |