What’s Vulnerable › Products
Cloud Foundry cf-deployment vulnerabilities
41 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.
Check whether your Cloud Foundry cf-deployment version is affected
Latest Cloud Foundry cf-deployment vulnerabilities
- CVE-2026-59358 — UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type (CVSS 7.6)
- CVE-2026-59357 — Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions (CVSS 6.5)
- CVE-2026-59335 — Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise (CVSS 8.7)
- CVE-2026-47840 — LDAP StartTLS unconditionally disables hostname verification (CVSS 7.5)
- CVE-2026-22726 — Route Services Firewall Bypass (CVSS 5.0)
- CVE-2026-22723 — UAA User Token Revocation logic error (CVSS 6.5)
- CVE-2025-22246 — CVE-2025-22246 – UAA Private Key Exposure (CVSS 7.5)
- CVE-2024-22279 — GoRouter Denial of Service Attack (CVSS 7.5)
- CVE-2023-34041 — CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter (CVSS 5.3)
- CVE-2023-20882 — (CVSS 5.9)
- CVE-2023-20881 — (CVSS 8.1)
- CVE-2022-31733 — (CVSS 9.1)
- CVE-2021-22100 — (CVSS 5.3)
- CVE-2021-22101 — (CVSS 7.5)
- CVE-2021-22098 — (CVSS 6.1)
- CVE-2021-22001 — (CVSS 7.5)
- CVE-2021-22115 — (CVSS 6.5)
- CVE-2020-5423 — Cloud Controller is vulnerable to denial of service via YAML parsing (CVSS 7.5)
- CVE-2020-5420 — Gorouter is vulnerable to DoS attack via invalid HTTP responses (CVSS 7.7)
- CVE-2020-5418 — Cloud Controller allows users with no roles to list droplets (CVSS 4.3)
- CVE-2020-5417 — Cloud Controller may allow developers to claim sensitive routes (CVSS 8.8)
- CVE-2020-5416 — CF clusters with NGINX in front of them may be vulnerable to DoS (CVSS 6.5)
- CVE-2020-15586 — (CVSS 5.9)
- CVE-2020-5402 — UAA fails to check the state parameter when authenticating with external IDPs (CVSS 8.8)
- CVE-2020-5400 — Cloud Controller logs environment variables from app manifests (CVSS 6.5)