{"resultsPerPage":1,"startIndex":0,"totalResults":6985,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-29T20:18:55.104","vulnerabilities":[{"cve":{"id":"CVE-2026-22726","sourceIdentifier":"security@vmware.com","published":"2026-05-01T00:16:23.650","lastModified":"2026-10-26T22:10:00.163","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks reachable by the Gorouter, which may not have previously had direct access from outside networks, or from the application.\nRouting release: affected from v0.118.0 through v0.371.0 (inclusive); upgrade to v0.372.0 or greater. CF Deployment: affected from v0.0.2 through v54.14.0 (inclusive); upgrade to v55.0.0 or greater (includes routing_release v0.372.0)."},{"lang":"es","value":"Los Servicios de Ruta pueden ser aprovechados para enviar tráfico de aplicaciones a destinos de red fuera de las reglas de egreso configuradas de una aplicación. Como resultado, un desarrollador malicioso con acceso a Cloudfoundry podría configurar un servicio de ruta que le permitiría enviar solicitudes a servicios HTTP en redes internas accesibles por el Gorouter, que quizás no habían tenido acceso directo previamente desde redes externas, o desde la aplicación.\nVersión de enrutamiento: afectada desde la v0.118.0 hasta la v0.371.0 (inclusive); actualizar a la v0.372.0 o superior. Despliegue de CF: afectado desde la v0.0.2 hasta la v54.14.0 (inclusive); actualizar a la v55.0.0 o superior (incluye la versión de enrutamiento v0.372.0)."}],"affected":[{"source":"security@vmware.com","affectedData":[{"vendor":"CloudFoundry Foundation","product":"Routing release","defaultStatus":"unaffected","versions":[{"version":"v0.118.0","lessThan":"v0.372.0","versionType":"custom","status":"affected"}]},{"vendor":"CloudFoundry Foundation","product":"CF Deployment","defaultStatus":"unaffected","versions":[{"version":"v0.0.2","lessThan":"v55.0.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@vmware.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-01T14:19:03.488133Z","id":"CVE-2026-22726","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@vmware.com","type":"Secondary","description":[{"lang":"en","value":"CWE-923"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:*","versionStartIncluding":"0.0.2","versionEndExcluding":"55.0.0","matchCriteriaId":"DF44134F-4993-470C-8445-F3A8CD29F7F7"},{"vulnerable":true,"criteria":"cpe:2.3:a:cloudfoundry:routing_release:*:*:*:*:*:*:*:*","versionStartIncluding":"0.118.0","versionEndExcluding":"0.372.0","matchCriteriaId":"EC7712BB-3C94-42C2-9EF8-E51296103886"}]}]}],"references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-22726-route-services-firewall-bypass/","source":"security@vmware.com","tags":["Vendor Advisory"]}]}}]}