What’s Vulnerable › Vulnerabilities
CVE-2019-11294: CAPI leaks service broker URLs and GUIDs to space developers
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-12-19 · updated 2026-06-17
- Weakness: CWE-200
Description
Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins.
Affected products
- Cloud Foundry CAPI: 1.88.0
- Cloud Foundry cf-deployment: before 12.7.0 — fixed in 12.7.0
How to fix
Upgrade to a fixed version: Cloud Foundry cf-deployment 12.7.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2019-11294 or the next vulnerability affects your stack