Improper certificate validation in Cloud Controller API
Priority LOW 37CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-295.
Summary
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00362 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cloud Controller API | Cloud Foundry cloud controller API versions between 1.140 and 1.152.0 and loggregator-agent v7+ | — | No fix listed | CNA |
- Cloud Controller API Vendor— Affected Cloud Foundry cloud controller API versions between 1.140 and 1.152.0 and loggregator-agent v7+ Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudfoundry:capi-release:*:*:*:*:*:*:*:* | 1.140 – 1.152.0 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* | 24.7.0 – 29.0.0 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:loggregator-agent:*:*:*:*:*:*:*:* | 7.0 – 7.2.1 | Vulnerable | CloudFoundry Foundation |
- cpe:2.3:a:cloudfoundry:capi-release:*:*:*:*:*:*:*:* Versions 1.140 – 1.152.0 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* Versions 24.7.0 – 29.0.0 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:loggregator-agent:*:*:*:*:*:*:*:* Versions 7.0 – 7.2.1 Vulnerable ·CloudFoundry Foundation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-20881
- 2026-10-03 Alias added: GHSA-gwjh-7ghx-8gww
References
More CloudFoundry Foundation Capi-release vulnerabilities
- TI-2020-04463 Cloud Controller may allow developers to claim sensitive routes CVSS 3.1HIGH 8.8
- TI-2018-01109 Insufficient session expiration in Dell EMC Cloud Controller CVSS 3.1HIGH 8.8
- TI-2019-02799 Cloud Controller provides signed URL with write authorization to read only user CVSS 3.1HIGH 8.1
- TI-2018-01171 Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure… CVSS 3.1HIGH 8.1
- TI-2017-05629 An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation… CVSS 3.1HIGH 7.8
- TI-2019-02810 Escalation of Privileges in Cloud Controller CVSS 3.0HIGH 7.5
Sources
- CVE-2023-20881 · CVE Program
- CVE-2023-20881 · NVD
- FIRST EPSS
- GHSA-gwjh-7ghx-8gww · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences