CVE-2026-22727

HIGH

7.5

Description

Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has bypassed the firewall to potentially replace droplets and therefore applications allowing them to access secure application information.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorADJACENT_NETWORK

ComplexityHIGH

Privileges RequiredNONE

User InteractionNONE

Published3/17/2026

Last Modified3/18/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-306

References

https://www.cloudfoundry.org/blog/cve-2026-22727-unprotected-internal-endpoints(security@vmware.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.