CVE-2026-22726

Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks reachable by the Gorouter, which may not have previously had direct access from outside networks, or from the application. Routing release: affected from v0.118.0 through v0.371.0 (inclusive); upgrade to v0.372.0 or greater. CF Deployment: affected from v0.0.2 through v54.14.0 (inclusive); upgrade to v55.0.0 or greater (includes routing_release v0.372.0).

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.cloudfoundry.org/blog/cve-2026-22726-route-services-firewall-bypass/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cloudfoundry:cf-deployment::::::::
	cpe:2.3:a:cloudfoundry:routing_release::::::::

History

No history.

Information

Published : 2026-05-01 00:16

Updated : 2026-06-17 10:20

NVD link : CVE-2026-22726

Mitre link : CVE-2026-22726

CVE.ORG link : CVE-2026-22726

JSON object : View

Products Affected

cloudfoundry

cf-deployment
routing_release

CWE

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

{"id": "CVE-2026-22726", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22726", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-01T14:19:03.488133Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "CloudFoundry Foundation", "product": "Routing release", "versions": [{"status": "affected", "version": "v0.118.0", "lessThan": "v0.372.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "CloudFoundry Foundation", "product": "CF Deployment", "versions": [{"status": "affected", "version": "v0.0.2", "lessThan": "v55.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-01T00:16:23.650", "references": [{"url": "https://www.cloudfoundry.org/blog/cve-2026-22726-route-services-firewall-bypass/", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-923"}]}], "descriptions": [{"lang": "en", "value": "Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks reachable by the Gorouter, which may not have previously had direct access from outside networks, or from the application.\nRouting release: affected from v0.118.0 through v0.371.0 (inclusive); upgrade to v0.372.0 or greater. CF Deployment: affected from v0.0.2 through v54.14.0 (inclusive); upgrade to v55.0.0 or greater (includes routing_release v0.372.0)."}], "lastModified": "2026-06-17T10:20:18.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF44134F-4993-470C-8445-F3A8CD29F7F7", "versionEndExcluding": "55.0.0", "versionStartIncluding": "0.0.2"}, {"criteria": "cpe:2.3:a:cloudfoundry:routing_release:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC7712BB-3C94-42C2-9EF8-E51296103886", "versionEndExcluding": "0.372.0", "versionStartIncluding": "0.118.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}