Cloud Foundry vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-59358 Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to High 7.6 · Oct 6, 2026
• CVE-2026-41012 Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API anHigh 7.7 · Aug 28, 2026
• CVE-2026-59335 Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authHigh 8.7 · Aug 25, 2026
• CVE-2026-41005 Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (auCritical 9 · Jun 11, 2026
• CVE-2026-22734 Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems.High 8.6 · Apr 16, 2026
• CVE-2024-37082 When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypasCritical 9.1 · Jul 3, 2024
• CVE-2023-34061 Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack.High 7.5 · Jan 12, 2024
• CVE-2020-5423 CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send speciallyHigh 7.5 · Dec 1, 2020
• CVE-2020-5420 Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pusHigh 7.7 · Sep 2, 2020
• CVE-2020-5417 Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the dHigh 8.8 · Aug 21, 2020
• CVE-2020-5402 In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when aHigh 8.8 · Feb 27, 2020
• CVE-2020-5399 Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS.High 7.4 · Feb 12, 2020
• CVE-2019-11290 Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file.High 7.5 · Nov 25, 2019
• CVE-2019-11289 Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input.High 8.6 · Nov 19, 2019
• CVE-2019-11283 Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs.High 8.8 · Oct 23, 2019
• CVE-2019-11279 CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes.High 8.8 · Sep 26, 2019
• CVE-2019-11278 CF UAA versions prior to 74.1.0, allow external input to be directly queried against.High 8.8 · Sep 26, 2019
• CVE-2019-11277 Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection.High 8.1 · Sep 23, 2019
• CVE-2019-11270 Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the reHigh 7.5 · Aug 5, 2019
• CVE-2019-3787 Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does notHigh 8.3 · Jun 19, 2019
• CVE-2019-11271 Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database.High 7.8 · Jun 18, 2019
• CVE-2019-3801 Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building.Critical 9.8 · Apr 25, 2019
• CVE-2019-3788 Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri.High 8.7 · Apr 25, 2019
• CVE-2019-3786 Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH.High 7.1 · Apr 24, 2019
• CVE-2019-3785 Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization.High 8.1 · Mar 13, 2019