Cloud Foundry vulnerabilities

CVEs per yearBy the year they were published

1. 201823
2. 201929
3. 202010
4. 20232
5. 20244
6. 20252
7. 202610

Newest CVEs

• CVE-2026-59387

  Broken access control restriction in Cloud Controller API

  Cloud Foundry · CAPI (Cloud Controller API)

  High8.8
• CVE-2026-59385

  Space Developer can extract space-scoped broker credentials

  Cloud Foundry · CAPI (Cloud Foundry Controller)

  Low2.7
• CVE-2026-59386

  Credential exposure to space supporter

  Cloud Foundry · Cloud Foundry Controller (CAPI)

  Medium6.5
• CVE-2026-59396

  DoS Vulnerability in UAA Related to JWKS URI Handling

  Cloud Foundry · UAA

  Medium6.9
• CVE-2026-59357

  Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions

  Cloud Foundry · UAA

  Medium6.5
• CVE-2026-59358

  UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

  Cloud Foundry · UAA

  High7.6
• CVE-2026-41012

  BOSH vSphere CPI Improper Cert Validation

  Cloud Foundry · bosh-vsphere-cpi-release

  High7.7
• CVE-2026-59335

  Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise

  Cloud Foundry · UAA

  High8.7
• CVE-2026-41005

  UAA accepts SAML Encrypted Assertions authentication bypass

  Cloud Foundry · UAA

  Critical9.0
• CVE-2026-22734

  Cloud Foundry UAA SAML 2.0 Signature Bypass

  Cloud Foundry · UUA

  High8.6