CF Deployment vulnerabilities

3 known vulnerabilities in CF Deployment from Cloud Foundry Foundation. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.2 Critical severity

  UAA: Improper Access Control

  CVE-2026-47839Sep 11, 2026Cloud Foundry Foundation

  A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider

• 10.0 Critical severity

  uaa_release: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-40965Jun 1, 2026Cloud Foundry Foundation

  Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed through the public /token_keys endpoint. This endpoint is design

• 7.5 High severity

  log-cache_release: Improper Authentication

  CVE-2026-40964Jun 1, 2026Cloud Foundry Foundation

  Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and platform component via minting a JWT that the cf-auth-proxy acc