CVE-2026-22727CWE-306

Cloud Foundry unprotected internal endpoints

High · published March 17, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has bypassed the firewall to potentially replace droplets and therefore applications allowing them to access secure application information.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-03-17T22:45Z
EPSS history
Timeline
  • 17 MAR 22:45Z
    Cloud Foundry unprotected internal endpoints
    cvelistv5