Cloud Foundry Foundation vulnerabilities
We track 9 vulnerabilities in Cloud Foundry Foundation products across 8 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on September 11, 2026.
Latest Cloud Foundry Foundation vulnerabilities
- 9.2 Critical severity
UAA: Improper Access Control
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider
- 7.5 High severity
BOSH CLI: Improper Neutralization of Special Elements used in a Command
Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities
- 8.2 High severity
BOSH Director: Improper Neutralization of Special Elements used in an OS Command
ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside t
- 8.8 High severity
BOSH: Inadequate Encryption Strength
CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to interce
- 7.8 High severity
BOSH: Improper Certificate Validation
A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administr
- 7.5 High severity
windows-utilities-release: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. Th
- 8.2 High severity
BOSH: Improper Neutralization of Special Elements used in an OS Command
PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh,
- 10.0 Critical severity
uaa_release: Exposure of Sensitive Information to an Unauthorized Actor
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed through the public /token_keys endpoint. This endpoint is design
- 7.5 High severity
log-cache_release: Improper Authentication
Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and platform component via minting a JWT that the cf-auth-proxy acc