PT-2026-25958 · Cloud Foundry · Cf-Deployment+1

CVE-2026-22727 · Publicado 2026-03-17 · Atualizado 2026-03-18

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Capi versions 1.226.0 and earlier CF Deployment versions v54.9.0 and earlier

Description The presence of unprotected internal endpoints in Cloud Foundry allows a user who has bypassed the firewall to potentially replace droplets and, consequently, applications. This access could lead to the exposure of secure application information. The affected components are Cloud Foundry Capi Release 1.226.0 and versions prior, and CF Deployment v54.9.0 and versions prior, across all platforms. A droplet is a packaged application ready for deployment.

Recommendations Update Cloud Foundry Capi to a version later than 1.226.0. Update CF Deployment to a version later than v54.9.0.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-22727

Produtos afetados

Cf-Deployment

Cloud Foundry Capi

Referências · 3

• https://twitter.com/CVEnew/status/2034136456755568904 · Publicação no Twitter
• https://cloudfoundry.org/blog/cve-2026-22727-unprotected-internal-endpoints · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22727 · Nota de Segurança