{"id":"CVE-2026-40964","state":"PUBLISHED","title":"Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every","description":"Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and platform component via minting a JWT that the cf-auth-proxy accepts as a valid logs.admin token.\n\nAffected versions:\n- log-cache_release: all versions through v3.2.6 (inclusive); fixed in v3.2.7 or later\n- CF Deployment: all versions through v55.?.0 (inclusive); fixed in v55.?.0 or later (bundles log-cache_release v3.2.7)","publishedAt":"2026-06-01T21:02:26.532Z","updatedAt":"2026-06-11T20:30:27.518Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"vmware"},"assigner":"vmware","products":["Cloud Foundry Foundation log-cache_release","Cloud Foundry Foundation CF Deployment"],"affected":[{"vendor":"Cloud Foundry Foundation","product":"log-cache_release","defaultStatus":"unaffected","versions":[{"version":"2.7.0","status":"affected","lessThanOrEqual":"3.2.6","versionType":"custom"}]},{"vendor":"Cloud Foundry Foundation","product":"CF Deployment","defaultStatus":"unaffected","versions":[{"version":"12.44.0","status":"affected","lessThanOrEqual":"55.2.0","versionType":"custom"}]}],"references":["https://www.cloudfoundry.org/blog/cve-2026-40964-read-access-to-cf-logs/"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/40xxx/CVE-2026-40964.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-40964","state":"PUBLISHED","datePublished":"2026-06-01T21:02:26.532Z","dateUpdated":"2026-06-11T20:30:27.518Z","assignerShortName":"vmware","assignerOrgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","dateReserved":"2026-04-16T02:18:56.132Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and platform component via minting a JWT that the cf-auth-proxy accepts as a valid logs.admin token.\n\nAffected versions:\n- log-cache_release: all versions through v3.2.6 (inclusive); fixed in v3.2.7 or later\n- CF Deployment: all versions through v55.?.0 (inclusive); fixed in v55.?.0 or later (bundles log-cache_release v3.2.7)"}],"affected":[{"vendor":"Cloud Foundry Foundation","product":"log-cache_release","defaultStatus":"unaffected","versions":[{"version":"2.7.0","status":"affected","lessThanOrEqual":"3.2.6","versionType":"custom"}]},{"vendor":"Cloud Foundry Foundation","product":"CF Deployment","defaultStatus":"unaffected","versions":[{"version":"12.44.0","status":"affected","lessThanOrEqual":"55.2.0","versionType":"custom"}]}],"references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-40964-read-access-to-cf-logs/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","lang":"en","description":"CWE-287: Improper Authentication","type":"CWE"}]}],"providerMetadata":{"shortName":"vmware","orgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","dateUpdated":"2026-06-11T20:30:27.518Z"},"impacts":[{"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can gain read access to all logs and metrics for every application and platform component (confidentiality impact: HIGH; integrity and availability unaffected)."}]}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-02T13:11:40.431179Z","id":"CVE-2026-40964","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-02T13:11:52.780Z"}}]}}}