# Cloud Foundry Foundation vulnerabilities Source: https://junglewise.ai/threats/vendors/cloud-foundry-foundation Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/cloud-foundry-foundation.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Cloud Foundry Foundation: 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-59388, was published on 30 October 2026. 3 vulnerabilities in the last four weeks, up from none in the four before. 3 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 4 - All time: 17 (0 critical, 0 exploited in the wild) ## About Cloud Foundry Foundation An open source multi-cloud platform as a service (PaaS) governed by the Cloud Foundry Foundation. ## Latest Cloud Foundry Foundation vulnerabilities - [CVE-2026-59388: Cloud Foundry Cloud Controller credential exposure in audit logs](https://junglewise.ai/threats/cve-2026-59388-cloud-controller-capi-leaks-sensitive-data-into-audit-logs-in) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-59387: Cloud Foundry CAPI broken access control in /internal/v3/ endpoints](https://junglewise.ai/threats/cve-2026-59387-the-nginx-routing-configuration-for-cloud-controller-blocks) (high, CVSS 8.8, published 30 Oct 2026) - [CVE-2026-59386: Cloud Foundry CAPI privilege escalation to credential exposure](https://junglewise.ai/threats/cve-2026-59386-a-spacesupporter-could-improperly-modify-an-application-s-start) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-41012: Cloud Foundry BOSH VSphere CPI certificate validation bypass](https://junglewise.ai/threats/cve-2026-41012-cloud-foundry-bosh-vsphere-cpi-certificate-validation-bypass) (high, CVSS 7.7, published 29 Aug 2026) - [CVE-2026-47831: Cloud Foundry bosh-windows-stemcell-builder weak RNG in GenerateRandomPassword](https://junglewise.ai/threats/cve-2026-47831-cloud-foundry-bosh-windows-stemcell-builder-weak-rng-in) (high, CVSS 7.5, published 9 Jul 2026) - [CVE-2026-47830: Cloud Foundry BOSH stemcell builder privilege escalation in BOSH.Utils.psm1](https://junglewise.ai/threats/cve-2026-47830-cloud-foundry-bosh-stemcell-builder-privilege-escalation-in-bosh) (high, CVSS 8.8, published 9 Jul 2026) - [CVE-2026-47833: Cloud Foundry bpm-release symlink following in setupBpmLogs](https://junglewise.ai/threats/cve-2026-47833-cloud-foundry-bpm-release-symlink-following-in-setupbpmlogs) (medium, CVSS 6.1, published 18 Jun 2026) - [CVE-2026-41010: Cloud Foundry BOSH Director command injection in ReleaseJob unpack](https://junglewise.ai/threats/cve-2026-41010-cloud-foundry-bosh-director-command-injection-in-releasejob) (high, CVSS 8.2, published 4 Jun 2026) - [CVE-2026-41860: Cloud Foundry BOSH insecure TLS verification in bosh-monitor](https://junglewise.ai/threats/cve-2026-41860-cloud-foundry-bosh-insecure-tls-verification-in-bosh-monitor) (high, CVSS 8.8, published 4 Jun 2026) - [CVE-2026-41859: Cloud Foundry BOSH improper certificate validation in nats-sync](https://junglewise.ai/threats/cve-2026-41859-cloud-foundry-bosh-improper-certificate-validation-in-nats-sync) (high, CVSS 7.8, published 4 Jun 2026) - [CVE-2026-41858: Cloud Foundry windows-utilities-release Weak PRNG in Get-RandomPassword](https://junglewise.ai/threats/cve-2026-41858-cloud-foundry-windows-utilities-release-weak-prng-in-get) (high, CVSS 7.5, published 4 Jun 2026) - [CVE-2026-41011: Cloud Foundry BOSH command injection in PackagePersister](https://junglewise.ai/threats/cve-2026-41011-cloud-foundry-bosh-command-injection-in-packagepersister) (high, CVSS 8.2, published 4 Jun 2026) - [CVE-2026-40964: Cloud Foundry cf-auth-proxy authentication bypass](https://junglewise.ai/threats/cve-2026-40964-cloud-foundry-cf-auth-proxy-authentication-bypass) (high, CVSS 7.5, published 1 Jun 2026) - [CVE-2026-41013: CloudFoundry smb-volume-release input validation bypass in SMB mount handling](https://junglewise.ai/threats/cve-2026-41013-cloudfoundry-smb-volume-release-input-validation-bypass-in-smb) (info, CVSS 8.5, published 1 Jun 2026) - [CVE-2026-41704: Cloud Foundry BOSH Director improper access control in AgentClient](https://junglewise.ai/threats/cve-2026-41704-cloud-foundry-bosh-director-improper-access-control-in) (medium, CVSS 5, published 27 May 2026) - [CVE-2026-41009: Cloud Foundry BOSH Director path traversal in local blobstore](https://junglewise.ai/threats/cve-2026-41009-cloud-foundry-bosh-director-path-traversal-in-local-blobstore) (medium, CVSS 5.8, published 27 May 2026) - [CVE-2016-9882: Cloud Foundry Cloud Controller sensitive information disclosure in logs](https://junglewise.ai/threats/cve-2016-9882-cloud-foundry-cloud-controller-sensitive-information-disclosure-in) (high, CVSS 7.5, published 13 Jan 2017) ## Most severe Cloud Foundry Foundation vulnerabilities - [CVE-2026-59387: Cloud Foundry CAPI broken access control in /internal/v3/ endpoints](https://junglewise.ai/threats/cve-2026-59387-the-nginx-routing-configuration-for-cloud-controller-blocks) (high, CVSS 8.8, published 30 Oct 2026) - [CVE-2026-47830: Cloud Foundry BOSH stemcell builder privilege escalation in BOSH.Utils.psm1](https://junglewise.ai/threats/cve-2026-47830-cloud-foundry-bosh-stemcell-builder-privilege-escalation-in-bosh) (high, CVSS 8.8, published 9 Jul 2026) - [CVE-2026-41860: Cloud Foundry BOSH insecure TLS verification in bosh-monitor](https://junglewise.ai/threats/cve-2026-41860-cloud-foundry-bosh-insecure-tls-verification-in-bosh-monitor) (high, CVSS 8.8, published 4 Jun 2026) - [CVE-2026-41010: Cloud Foundry BOSH Director command injection in ReleaseJob unpack](https://junglewise.ai/threats/cve-2026-41010-cloud-foundry-bosh-director-command-injection-in-releasejob) (high, CVSS 8.2, published 4 Jun 2026) - [CVE-2026-41011: Cloud Foundry BOSH command injection in PackagePersister](https://junglewise.ai/threats/cve-2026-41011-cloud-foundry-bosh-command-injection-in-packagepersister) (high, CVSS 8.2, published 4 Jun 2026) - [CVE-2026-41859: Cloud Foundry BOSH improper certificate validation in nats-sync](https://junglewise.ai/threats/cve-2026-41859-cloud-foundry-bosh-improper-certificate-validation-in-nats-sync) (high, CVSS 7.8, published 4 Jun 2026) - [CVE-2026-41012: Cloud Foundry BOSH VSphere CPI certificate validation bypass](https://junglewise.ai/threats/cve-2026-41012-cloud-foundry-bosh-vsphere-cpi-certificate-validation-bypass) (high, CVSS 7.7, published 29 Aug 2026) - [CVE-2026-47831: Cloud Foundry bosh-windows-stemcell-builder weak RNG in GenerateRandomPassword](https://junglewise.ai/threats/cve-2026-47831-cloud-foundry-bosh-windows-stemcell-builder-weak-rng-in) (high, CVSS 7.5, published 9 Jul 2026) - [CVE-2026-41858: Cloud Foundry windows-utilities-release Weak PRNG in Get-RandomPassword](https://junglewise.ai/threats/cve-2026-41858-cloud-foundry-windows-utilities-release-weak-prng-in-get) (high, CVSS 7.5, published 4 Jun 2026) - [CVE-2026-40964: Cloud Foundry cf-auth-proxy authentication bypass](https://junglewise.ai/threats/cve-2026-40964-cloud-foundry-cf-auth-proxy-authentication-bypass) (high, CVSS 7.5, published 1 Jun 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Cloud Foundry Foundation technologies - [Cloud Foundry Foundation Bosh](https://junglewise.ai/threats/technologies/bosh): 3 vulnerabilities - [Cloud Foundry Foundation Bosh-Director](https://junglewise.ai/threats/technologies/bosh-director): 3 vulnerabilities - [Cloud Foundry Foundation Cf-Deployment](https://junglewise.ai/threats/technologies/cloud-foundry-foundation-cf-deployment): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Cloud Foundry Foundation vulnerabilities", https://junglewise.ai/threats/vendors/cloud-foundry-foundation, 9 November 2026.