CVE-2026-40964

HighCVSS 7.5/10Last modified Jul 22, 2026

Description

Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and platform component via minting a JWT that the cf-auth-proxy accepts as a valid logs.admin token.

Affected versions: - log-cache_release: all versions through v3.2.6 (inclusive); fixed in v3.2.7 or later - CF Deployment: all versions through v55.?.0 (inclusive); fixed in v55.?.0 or later (bundles log-cache_release v3.2.7)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-4096510.0Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC CVE-2026-409665.9In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secr CVE-2026-409678.6In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector stor CVE-2026-409688.8When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can b CVE-2026-409695.3The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description CVE-2026-409706.8When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting CVE-2026-409719.1When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to th CVE-2026-409727.5An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote se CVE-2026-409737.0A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.se CVE-2026-409749.8Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affecte CVE-2026-409757.5Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} sho CVE-2026-409769.1In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an applicatio