CloudFoundry Foundation vulnerabilities
We track 4 vulnerabilities in CloudFoundry Foundation products across 5 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest CloudFoundry Foundation vulnerabilities
- 7.3 High severity
bosh-openstack-cpi-release: Insertion of Sensitive Information into Log File
The vulnerability lies in the way application credentials are handled within the BOSH deployment. bosh-openstack-cpi-release: all versions from v55 to v55.0.4 (inclusive)
- 7.8 High severity
bosh-cli: Improper Neutralization of Argument Delimiters in a Command
Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution o
- 9.1 Critical severity
BOSH CLI tool: Improper Limitation of a Pathname to a Restricted Directory
The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected versions: BOSH CLI tool versions prior to v7.10.4.
- 8.1 High severity
smb-volume-release: Improper Neutralization of Argument Delimiters in a Command
Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount options via bypassing the mount-option allowlist, enabling privilege escalation and sec