Cloudfoundry vulnerabilities
We track 6 vulnerabilities in Cloudfoundry products across 7 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 9, 2026.
Latest Cloudfoundry vulnerabilities
- 9.1 Critical severity
BOSH CLI tool: Improper Limitation of a Pathname to a Restricted Directory
The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected versions: BOSH CLI tool versions prior to v7.10.4.
- 7.5 High severity
Cloud Foundry: Missing Authentication for Critical Functionality
Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has bypassed the firewall to potentially replace droplets and therefore applications allowing them to acces
- 9.1 Critical severity
haproxy-boshrelease: Authentication Bypass by Spoofing
When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications. You are affected if you have route-services ena
- 7.5 High severity
Routing Release: Inconsistent Interpretation of HTTP Requests
Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale.
- 8.1 High severity
Cloud Controller API: Improper Certificate Validation
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has z
- 9.1 Critical severity
Cloud Foundry Diego and CF Deployment: Improper Certificate Validation
Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND u