Cloud Foundry vulnerabilities
We track 9 vulnerabilities in Cloud Foundry products across 7 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Cloud Foundry vulnerabilities
- 8.8 High severity
CAPI (Cloud Controller API): Improper Access Control
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_
- 7.6 High severity
UAA: Improper Authentication
Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presentin
- 7.7 High severity
bosh-vsphere-cpi-release: Improper Certificate Validation
Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastr
- 8.7 High severity
UAA: Improper Handling of Case Sensitivity
Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that th
- 9.0 Critical severity
UAA: Improper Verification of Cryptographic Signature
Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (authenticity) in two SAML flows: the OAuth 2.0 SAML2 bearer grant (token endpoint) and browser SSO (AC
- 8.6 High severity
UUA: Authentication Bypass by Spoofing
Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer
- 9.1 Critical severity
haproxy-boshrelease: Authentication Bypass by Spoofing
When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications. You are affected if you have route-services ena
- 7.5 High severity
Routing Release: Inconsistent Interpretation of HTTP Requests
Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale.
- 7.5 High severity
Routing Release: Uncontrolled Resource Consumption
Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.