Skip to content
OpenAdvisories

Vendor

Cloud Foundry Foundation

15 known vulnerabilities.

Cloud Foundry Foundation at a glance

Last 12 months
15
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 2 vulnerabilities June 2026: 8 vulnerabilities, 1 critical Jun July 2026: 2 vulnerabilities August 2026: 1 vulnerability September 2026: 1 vulnerability, 1 critical Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202611
Aug 202610
Jul 202620
Jun 202681
May 202620
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

cf-deployment 4 BOSH 3 BOSH Director 3 bosh-windows-stemcell-builder 2 UAA 1 uaa_release 1 BOSH CLI 1 bpm-release 1 CAPI (Cloud Foundry Controller) 1 windows-utilities-release 1 log-cache_release 1
All Critical High Medium Low Exploited only Public exploit

15 results · Feed

  • Medium 6.5
    CVE-2026-59388

    Cloud Controller exposes secrets in audit log

    Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service…

    Cloud Foundry Foundation cf-deployment CAPI (Cloud Foundry Controller)
  • Critical 9.2
    CVE-2026-47839

    Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

    A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider…

    Cloud Foundry Foundation cf-deployment UAA
  • High 7.5
    CVE-2026-47827

    CVE-2026-47827 – BOSH CLI Powershell Injection

    Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities

    Cloud Foundry Foundation BOSH CLI
  • High 7.5
    CVE-2026-47831

    Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks

    Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows a remote attacker to brute-force the resulting SSH login via TCP/22. Affected versions: bosh-windows-stemcell-builder versio…

    Cloud Foundry Foundation bosh-windows-stemcell-builder Windows
  • High 8.8
    CVE-2026-47830

    Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite

    Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service res…

    Cloud Foundry Foundation bosh-windows-stemcell-builder Windows
  • Medium 6.1
    CVE-2026-47833

    setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A com…

    Cloud Foundry Foundation bpm-release
  • High 8.2
    CVE-2026-41010

    ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', …

    Cloud Foundry Foundation BOSH Director
  • High 8.2
    CVE-2026-41011

    PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz"…

    Cloud Foundry Foundation BOSH
  • Medium 6.5
    CVE-2026-41858

    Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilitie…

    Cloud Foundry Foundation windows-utilities-release Windows
  • High 7.8
    CVE-2026-41859

    A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth head…

    Cloud Foundry Foundation BOSH
  • High 8.8
    CVE-2026-41860

    CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRe…

    Cloud Foundry Foundation BOSH
  • Critical 10.0
    CVE-2026-40965

    Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vu…

    Cloud Foundry Foundation cf-deployment uaa_release
  • High 7.5
    CVE-2026-40964

    Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote a…

    Cloud Foundry Foundation cf-deployment log-cache_release
  • Medium 5.0
    CVE-2026-41704

    Compromised VM can make arbitrary blobstore deletes

    AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any…

    Cloud Foundry Foundation BOSH Director
  • Medium 5.8
    CVE-2026-41009

    Local Blobstore may allow arbitrary reads/deletes

    When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 332-339) reads response['value']['result']['compile_log_id'] and format_exception (line 318-325) reads exception…

    Cloud Foundry Foundation BOSH Director