Skip to content
OpenAdvisories

Vendor

Cloud Foundry Foundation

15 known vulnerabilities.

Products

cf-deployment 4 BOSH 3 BOSH Director 3 bosh-windows-stemcell-builder 2 UAA 1 uaa_release 1 BOSH CLI 1 bpm-release 1 CAPI (Cloud Foundry Controller) 1 windows-utilities-release 1 log-cache_release 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-59388

    Cloud Controller exposes secrets in audit log

    Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service…

    Cloud Foundry Foundation cf-deployment CAPI (Cloud Foundry Controller)
  • Medium 6.1
    CVE-2026-47833

    setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A com…

    Cloud Foundry Foundation bpm-release
  • Medium 6.5
    CVE-2026-41858

    Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilitie…

    Cloud Foundry Foundation windows-utilities-release Windows
  • Medium 5.0
    CVE-2026-41704

    Compromised VM can make arbitrary blobstore deletes

    AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any…

    Cloud Foundry Foundation BOSH Director
  • Medium 5.8
    CVE-2026-41009

    Local Blobstore may allow arbitrary reads/deletes

    When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 332-339) reads response['value']['result']['compile_log_id'] and format_exception (line 318-325) reads exception…

    Cloud Foundry Foundation BOSH Director