TI-2026-18251 Aliases CVE-2026-22726 GHSA-rmvv-67vj-q642

Route Services Firewall Bypass

LOW 22CWE-923Published 2026-04-30 · Updated 2026-05-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks reachable by the Gorouter, which may not have previously had direct access from outside networks, or from the application. Routing release: affected from v0.118.0 through v0.371.0 (inclusive); upgrade to v0.372.0 or greater. CF Deployment: affected from v0.0.2 through v54.14.0 (inclusive); upgrade to v55.0.0 or greater (includes routing_release v0.372.0).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00199 9th percentileScored 2026-11-07

Fix Fixed Routing release (CloudFoundry Foundation): v0.372.0CF Deployment (CloudFoundry Foundation): v55.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
CloudFoundry Foundation	Routing release	v0.118.0 to before v0.372.0	v0.372.0	Patch available	CNA
CloudFoundry Foundation	CF Deployment	v0.0.2 to before v55.0.0	v55.0.0	Patch available	CNA

Routing release VendorCloudFoundry Foundation Affected v0.118.0 to before v0.372.0 Fixed in v0.372.0 Patch available CNA
CF Deployment VendorCloudFoundry Foundation Affected v0.0.2 to before v55.0.0 Fixed in v55.0.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:cloudfoundry:cf-deployment::::::::	0.0.2 to before 55.0.0	Vulnerable	CloudFoundry Foundation
cpe:2.3:a:cloudfoundry:routing_release::::::::	0.118.0 to before 0.372.0	Vulnerable	CloudFoundry Foundation

cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* Versions 0.0.2 to before 55.0.0 Vulnerable ·CloudFoundry Foundation
cpe:2.3:a:cloudfoundry:routing_release:*:*:*:*:*:*:*:* Versions 0.118.0 to before 0.372.0 Vulnerable ·CloudFoundry Foundation

Remediation

Fix · CNA Routing release (CloudFoundry Foundation) Fixed in v0.372.0
Fix · CNA CF Deployment (CloudFoundry Foundation) Fixed in v55.0.0

Timeline

2026-10-02 Threatist record created from CVE-2026-22726
2026-10-03 Alias added: GHSA-rmvv-67vj-q642

References

Advisory 1

https://www.cloudfoundry.org/blog/cve-2026-22726-route-services-firewall-bypass/

TI-2022-13629 Improper certificate validation in Cloud Foundry Diego and CF Deployment CVSS 3.1CRITICAL 9.1
TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
TI-2019-08441 Password leak in smbdriver logs CVSS 3.1HIGH 8.8
TI-2020-04463 Cloud Controller may allow developers to claim sensitive routes CVSS 3.1HIGH 8.8
TI-2019-08446 A forged route service request using an invalid nonce can cause the gorouter to panic and crash CVSS 3.1HIGH 8.6
TI-2018-01109 Insufficient session expiration in Dell EMC Cloud Controller CVSS 3.1HIGH 8.8

See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences