Skip to content
OpenAdvisories

Vendor

Cloud Foundry

80 known vulnerabilities.

Products

CF Deployment 20 UAA Release (OSS) 10 UAA 9 UAA Release 6 CAPI 6 Routing 5 Cloud Foundry UAA 3 Garden-runC 3 CF CLI 2 bits-service-release 2 CF NFS volume release 2 CredHub 2 BOSH 2 Cloud Foundry Container Runtime (CFCR) 2 Stratos 2 Routing Release 2 Loggregator 2 Cloud Foundry 2 CAPI (Cloud Foundry Controller) 1 Cloud Foundry Router 1 CredHub CLI 1 Container Runtime 1 haproxy-boshrelease 1 Windows2012R2 stemcell 1 NFS Volume Release 1 Notifications 1 CF CLI Release 1 SMB-volume release 1 Cloud Controller 1 SMB Volume 1 CF Networking Release 1 CAPI (Cloud Controller API) 1 UUA 1 CloudFoundry UAA 1 bosh-vsphere-cpi-release 1 BOSH Backup and Restore 1 CAPI-release 1 log-cache-release 1 BOSH System Metrics Server 1 Cloud Foundry Controller (CAPI) 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-41005

    UAA accepts SAML Encrypted Assertions authentication bypass

    Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (authenticity) in two SAML flows: the OAuth 2.0 SAML2 bearer grant (token endpoint) and browser SSO (A…

    Cloud Foundry CF Deployment UAA
  • Critical 9.1
    CVE-2024-37082

    When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be p…

    Cloud Foundry haproxy-boshrelease
  • Critical 9.1
    CVE-2019-3780

    Cloud Foundry Container Runtime Leaks IAAS Credentials

    Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to…

    Cloud Foundry Cloud Foundry Container Runtime (CFCR)
  • Critical 9.9
    CVE-2018-15761

    UAA Privilege Escalation

    Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitra…

    Cloud Foundry UAA UAA Release org.cloudfoundry.identity:cloudfoundry-identity-server Maven
  • Critical 9.1
    CVE-2018-1264

    Log Cache logs UAA client secret on startup

    Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client.…

    Cloud Foundry log-cache-release