Cloudfoundry
65 CVEs across 34 Cloudfoundry products. Browse Cloudfoundry vulnerabilities, severities, and proof-of-concept exploits.
Cloudfoundry products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47829 | High | 7.8 | 2026-07-09 | Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator run… |
CVE-2026-47828 | High | 8.8 | 2026-07-09 | During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without v… |
CVE-2026-47826 | Critical | 9.1 | 2026-07-09 | The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected… |
CVE-2026-41857 | High | 7.8 | 2026-07-09 | A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh l… |
CVE-2026-22726 | Medium | 5.0 | 2026-05-01 | Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer wit… |
CVE-2026-22727 | High | 7.5 | 2026-03-17 | Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has by… |
CVE-2026-22723 | Medium | 6.5 | 2026-03-05 | Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfo… |
CVE-2025-22246 | Low | 3.0 | 2025-05-13 | Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. |
CVE-2024-22279 | Medium | 5.9 | 2024-06-10 | Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Clou… |
CVE-2023-34041 | Medium | 5.3 | 2023-09-08 | Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerabil… |
CVE-2023-20882 | Medium | 5.9 | 2023-05-26 | In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hoste… |
CVE-2023-20881 | High | 8.1 | 2023-05-19 | Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if the… |
CVE-2023-20903 | Medium | 4.3 | 2023-03-28 | This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to… |
CVE-2022-31733 | Critical | 9.1 | 2023-02-03 | Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells… |
CVE-2018-25046 | Critical | 9.1 | 2022-12-27 | Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory. |
CVE-2021-22100 | Medium | 5.3 | 2022-03-25 | In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) cau… |
CVE-2021-22101 | High | 7.5 | 2021-10-27 | Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause d… |
CVE-2021-22098 | Medium | 6.1 | 2021-08-11 | UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social en… |
CVE-2021-22001 | High | 7.5 | 2021-07-22 | In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provi… |
CVE-2021-22115 | Medium | 6.5 | 2021-04-08 | Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. CAPI database logs s… |
CVE-2020-5423 | High | 7.5 | 2020-12-02 | CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send speciall… |
CVE-2020-5420 | High | 7.7 | 2020-09-03 | Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pu… |
CVE-2020-5418 | Medium | 4.3 | 2020-09-03 | Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spa… |
CVE-2020-5417 | High | 8.8 | 2020-08-21 | Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the… |
CVE-2020-5416 | Medium | 6.5 | 2020-08-21 | Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vul… |
CVE-2020-15586 | Medium | 5.9 | 2020-07-17 | Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a r… |
CVE-2020-5402 | High | 8.8 | 2020-02-27 | In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when… |
CVE-2020-5401 | Medium | 5.3 | 2020-02-27 | Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to… |
CVE-2020-5400 | Medium | 6.5 | 2020-02-27 | Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information… |
CVE-2020-5399 | High | 7.4 | 2020-02-12 | Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the… |
CVE-2019-11294 | Medium | 4.3 | 2019-12-19 | Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs… |
CVE-2019-11293 | Medium | 6.5 | 2019-12-06 | Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote… |
CVE-2019-11290 | High | 7.5 | 2019-11-26 | Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentica… |
CVE-2019-11289 | High | 8.6 | 2019-11-19 | Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route s… |
CVE-2019-11283 | High | 8.8 | 2019-10-23 | Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs ca… |
CVE-2019-11282 | Medium | 4.3 | 2019-10-23 | Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim… |
CVE-2019-11279 | High | 8.8 | 2019-09-26 | CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user c… |
CVE-2019-11278 | High | 8.8 | 2019-09-26 | CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft… |
CVE-2019-11277 | High | 8.1 | 2019-09-23 | Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malic… |
CVE-2019-11274 | Medium | 6.1 | 2019-08-09 | Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM… |
CVE-2019-3801 | Critical | 9.8 | 2019-04-25 | Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote… |
CVE-2019-3788 | High | 8.7 | 2019-04-25 | Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wild… |
CVE-2019-3789 | Medium | 6.5 | 2019-04-24 | Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platfor… |
CVE-2019-3786 | High | 7.1 | 2019-04-24 | Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malic… |
CVE-2019-3798 | Medium | 6.0 | 2019-04-17 | Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated… |
CVE-2019-3785 | High | 8.1 | 2019-03-13 | Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read perm… |
CVE-2019-3780 | High | 8.8 | 2019-03-08 | Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user… |
CVE-2019-3779 | High | 8.8 | 2019-03-08 | Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for… |
CVE-2019-3784 | High | 8.2 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using… |
CVE-2019-3783 | High | 8.8 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brut… |
CVE-2019-3781 | High | 8.8 | 2019-03-07 | Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authent… |
CVE-2019-3775 | High | 7.1 | 2019-03-07 | Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by ch… |
CVE-2019-3782 | High | 7.8 | 2019-02-13 | Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config… |
CVE-2018-11084 | Medium | 6.8 | 2018-09-18 | Cloud Foundry Garden-runC release, versions prior to 1.16.1, prevents deletion of some app environments based on file attributes. A remote authenticated malici… |
CVE-2016-0708 | Medium | 5.9 | 2018-07-11 | Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to envi… |
CVE-2018-1269 | Medium | 6.5 | 2018-06-06 | Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not ha… |
CVE-2018-1268 | Medium | 6.8 | 2018-06-06 | Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not va… |
CVE-2018-1265 | High | 7.2 | 2018-06-06 | Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privi… |
CVE-2018-1193 | Medium | 5.3 | 2018-05-23 | Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded… |
CVE-2018-1262 | High | 7.2 | 2018-05-15 | Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients perform… |
CVE-2018-1277 | Medium | 6.5 | 2018-04-30 | Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. A remote authenticated user may push an ap… |
CVE-2016-2169 | Medium | 5.3 | 2018-04-18 | Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application devel… |
CVE-2016-6658 | Critical | 9.6 | 2018-03-29 | Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is… |
CVE-2018-1191 | High | 8.8 | 2018-03-29 | Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain le… |
CVE-2018-1267 | High | 8.1 | 2018-03-27 | Cloud Foundry Silk CNI plugin, versions prior to 0.2.0, contains an improper access control vulnerability. If the platform is configured with an application se… |
CVE-2018-1266 | High | 8.1 | 2018-03-27 | Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure and path traversal vulnerabilities. An authenticated malicious user c… |
CVE-2018-1221 | High | 8.1 | 2018-03-19 | In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers… |
CVE-2018-1195 | High | 8.8 | 2018-03-19 | In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tok… |
CVE-2015-5350 | High | 7.5 | 2018-03-19 | In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By… |
CVE-2018-1190 | Medium | 6.1 | 2018-01-04 | An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions… |
CVE-2017-14389 | Medium | 6.5 | 2017-11-28 | An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (al… |
CVE-2017-8031 | Medium | 5.3 | 2017-11-27 | An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4… |
CVE-2015-5173 | High | 8.8 | 2017-10-24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified… |
CVE-2015-5172 | Critical | 9.8 | 2017-10-24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified… |
CVE-2015-5171 | Critical | 9.8 | 2017-10-24 | The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7… |
CVE-2015-5170 | High | 8.8 | 2017-10-24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct c… |
CVE-2017-8048 | High | 7.8 | 2017-10-04 | In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original fix for CVE-2017-803… |
CVE-2017-8047 | Medium | 6.1 | 2017-10-04 | In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to appen… |
CVE-2016-0732 | High | 8.8 | 2017-09-07 | The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple… |
CVE-2016-0713 | Medium | 4.7 | 2017-08-31 | Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via vectors related to… |
CVE-2017-8037 | High | 7.5 | 2017-08-21 | In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplet… |
CVE-2017-8035 | High | 7.5 | 2017-07-25 | An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions… |
CVE-2017-8033 | High | 7.8 | 2017-07-25 | An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A… |
CVE-2017-8036 | High | 7.8 | 2017-07-24 | An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 (only). The original fix for CVE-2017-8033 included… |
CVE-2017-8034 | Medium | 6.6 | 2017-07-17 | The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions… |
CVE-2017-8032 | Medium | 6.6 | 2017-07-10 | In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3… |
CVE-2017-4994 | High | 7.5 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v263; UAA release 2.x versions prior to v2.7.4.18, 3.6.x versions prior to v3… |
CVE-2017-4992 | Critical | 9.8 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3… |
CVE-2017-4991 | High | 7.2 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3… |
CVE-2017-4974 | Medium | 6.5 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3… |
CVE-2017-4973 | High | 8.8 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3… |
CVE-2017-4972 | High | 7.5 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3… |
CVE-2017-4970 | Medium | 5.9 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release v255 and Staticfile buildpack versions v1.4.0 - v1.4.3. A regression introduced in the Static fi… |
CVE-2016-8219 | Medium | 6.5 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with the SpaceAuditor ro… |
CVE-2016-8218 | Critical | 9.8 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic i… |
CVE-2016-6655 | Critical | 9.8 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release versions prior to v31. A command injectio… |
CVE-2016-3084 | High | 8.1 | 2017-05-25 | The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA rele… |
CVE-2016-2165 | Medium | 6.5 | 2017-05-25 | The Loggregator Traffic Controller endpoints in cf-release v231 and lower, Pivotal Elastic Runtime versions prior to 1.5.19 AND 1.6.x versions prior to 1.6.20… |
CVE-2016-0781 | Medium | 6.1 | 2017-05-25 | The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and… |
CVE-2016-0780 | High | 7.5 | 2017-05-25 | It was discovered that cf-release v231 and lower, Pivotal Cloud Foundry Elastic Runtime 1.5.x versions prior to 1.5.17 and Pivotal Cloud Foundry Elastic Runtim… |