Skip to content
OpenAdvisories

Vendor

CloudFoundry Foundation

7 known vulnerabilities.

Products

Cf-deployment 3 UAA 2 Routing release 1 bosh-cli 1 BOSH CLI tool 1 BOSH 1 smb-volume-release 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-41861

    Arbitrary Root File Write via Path Traversal in BOSH agent

    Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Ali…

    CloudFoundry Foundation BOSH
  • Medium 5.0
    CVE-2026-22726

    Route Services Firewall Bypass

    Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTT…

    CloudFoundry Foundation Cf-deployment Routing release
  • Medium 6.5
    CVE-2026-22723

    UAA User Token Revocation logic error

    Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.

    CloudFoundry Foundation UAA org.cloudfoundry.identity:cloudfoundry-identity-server Maven