Security Advisory

CVE-2026-59358 – UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type.

Security Advisory

CVE-2026-59358 – UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type.

by Cloud Foundry Foundation Security Team October 5, 2026

CVE-2026-59357 – Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions

Security Advisory

CVE-2026-59357 – Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions

by Cloud Foundry Foundation Security Team October 5, 2026

Cloud Foundry Build Infrastructure Exposed to Secret Exfiltration via pull_request_target Workflows

Security Advisory

Cloud Foundry Build Infrastructure Exposed to Secret Exfiltration via pull_request_target Workflows

by Cloud Foundry Foundation Security Team September 22, 2026

CVE-2026-47839 – Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

Security Advisory

CVE-2026-47839 – Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

by Cloud Foundry Foundation Security Team September 7, 2026

CVE-2026-41012- BOSH VSphere CPI Improper Cert Validation

Security Advisory

CVE-2026-41012- BOSH VSphere CPI Improper Cert Validation

by Cloud Foundry Foundation Security Team August 27, 2026

CVE-2026-59335 – UAA case insensitive check bypass

Security Advisory

CVE-2026-59335 – UAA case insensitive check bypass

by Cloud Foundry Foundation Security Team August 24, 2026

CVE-2026-47827 – BOSH CLI Powershell Injection

Security Advisory

CVE-2026-47827 – BOSH CLI Powershell Injection

by Cloud Foundry Foundation Security Team August 20, 2026

CVE-2026-41861 – Arbitrary Root File Write via Path Traversal in BOSH agent

Security Advisory

CVE-2026-41861 – Arbitrary Root File Write via Path Traversal in BOSH agent

by Cloud Foundry Foundation Security Team August 6, 2026

CVE-2026-47840 – LDAP StartTLS unconditionally disables hostname verification

Security Advisory

CVE-2026-47840 – LDAP StartTLS unconditionally disables hostname verification

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47830 – Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite

Security Advisory

CVE-2026-47830 – Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47831 – Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks

Security Advisory

CVE-2026-47831 – Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47829 – Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director

Security Advisory

CVE-2026-47829 – Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director

by Cloud Foundry Foundation Security Team July 8, 2026