VDB
CVE-2026-22726
CVE-2026-22726
PUBLISHED
CVSS 5 MEDIUM
Reported by vmware · Published April 30, 2026
Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks reachable by the Gorouter, which may not have previously had direct access from outside networks, or from the application. Routing release: affected from v0.118.0 through v0.371.0 (inclusive); upgrade to v0.372.0 or greater. CF Deployment: affected from v0.0.2 through v54.14.0 (inclusive); upgrade to v55.0.0 or greater (includes routing_release v0.372.0).
EPSS 0.20% · 9.8th percentile
Risk Scores
CVSS 3.1
5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
EPSS Score
0.20%
9.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| CloudFoundry Foundation | Routing release | v0.118.0 |
| CloudFoundry Foundation | CF Deployment | v0.0.2 |
| CloudFoundry Foundation | CF Deployment | v0.0.2 |
| CloudFoundry Foundation | Routing release | v0.118.0 |
Timeline
- Apr 30, 2026 CVE Published
- May 4, 2026 CVE Updated
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score
- May 27, 2026 EPSS Score