Security Advisory

CVE-2026-47840 – LDAP StartTLS unconditionally disables hostname verification

Security Advisory

CVE-2026-47840 – LDAP StartTLS unconditionally disables hostname verification

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47830 – Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite

Security Advisory

CVE-2026-47830 – Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47831 – Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks

Security Advisory

CVE-2026-47831 – Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47829 – Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director

Security Advisory

CVE-2026-47829 – Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47828 – Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay

Security Advisory

CVE-2026-47828 – Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47826 – blobs.yaml Path Traversal Allows File Writes

Security Advisory

CVE-2026-47826 – blobs.yaml Path Traversal Allows File Writes

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-41857 – BOSH CLI Shell Injection

Security Advisory

CVE-2026-41857 – BOSH CLI Shell Injection

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47833 – Symlink vulnerability in setupBpmLogs allows container-to-host privilege escalation via /etc/shadow

Security Advisory

CVE-2026-47833 – Symlink vulnerability in setupBpmLogs allows container-to-host privilege escalation via /etc/shadow

by Cloud Foundry Foundation Security Team June 18, 2026

CVE-2026-41005 – UAA accepts SAML Encrypted Assertions authentication bypass

Security Advisory

CVE-2026-41005 – UAA accepts SAML Encrypted Assertions authentication bypass

by Cloud Foundry Foundation Security Team June 11, 2026

CVE-2026-41011 – Package Name Command Injection

Security Advisory

CVE-2026-41011 – Package Name Command Injection

by Cloud Foundry Foundation Security Team June 2, 2026

CVE-2026-41010 – Release Job Name Command Injection on BOSH Director

Security Advisory

CVE-2026-41010 – Release Job Name Command Injection on BOSH Director

by Cloud Foundry Foundation Security Team June 2, 2026

CVE-2026-41860 – Missing tls-verify on bosh-monitor

Security Advisory

CVE-2026-41860 – Missing tls-verify on bosh-monitor

by Cloud Foundry Foundation Security Team June 1, 2026