What is the CVSS score of CVE-2026-22726?

CVE-2026-22726 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Cloud Foundry Routing Release CVE-2026-22726

MEDIUM

Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)

2026-04-30 vmware

Information Disclosure Cf Deployment Routing Release Cloudfoundry Foundation

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 23:46 vuln.today

Analysis Generated

Apr 30, 2026 - 23:30 vuln.today

CVE Published

Apr 30, 2026 - 23:17 nvd

MEDIUM 5.0

DescriptionCVE.org

Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks reachable by the Gorouter, which may not have previously had direct access from outside networks, or from the application. Routing release: affected from v0.118.0 through v0.371.0 (inclusive); upgrade to v0.372.0 or greater. CF Deployment: affected from v0.0.2 through v54.14.0 (inclusive); upgrade to v55.0.0 or greater (includes routing_release v0.372.0).

AnalysisAI

Route Services in Cloud Foundry Routing Release v0.118.0-v0.371.0 and CF Deployment v0.0.2-v54.14.0 allow authenticated malicious developers to bypass application egress rules by configuring route-services that redirect traffic to internal network destinations otherwise unreachable from external networks or the application itself. This affects the scope of the routing infrastructure, enabling information disclosure and potential lateral movement within the Gorouter network.

Technical ContextAI

Cloud Foundry's Gorouter uses route-services as middleware that intercepts and can transform HTTP traffic destined for applications. The vulnerability exists in the routing release's handling of route-service configurations, which are typically set by developers with access to the platform. The CWE-923 classification (Improper Restriction of Communication Channel to Intended Endpoints) indicates the root cause: the platform fails to enforce egress rule restrictions when route-services are chained into the request path. When a malicious developer configures a route-service that acts as a proxy or redirector, the Gorouter will send requests through that service without validating that the final destination complies with the original application's network policy. This bypasses the intended network segmentation between applications and internal infrastructure.

RemediationAI

Upgrade Routing Release to v0.372.0 or greater. For CF Deployment, upgrade to v55.0.0 or greater, which includes the patched routing_release. Upgrading both components is necessary to fully resolve the vulnerability; upgrading only one may leave the environment partially exposed. Pending upgrade availability or testing, implement temporary mitigations: (1) Restrict route-service configuration capabilities to trusted administrators only by adjusting Cloud Foundry role-based access control (RBAC) settings and disabling self-service route-service creation for developers - this reduces attack surface but may impact application routing flexibility. (2) Implement network-level egress controls on the Gorouter hosts themselves via firewall rules or service mesh policies to block unexpected outbound connections to internal networks - this provides defense-in-depth but requires detailed knowledge of legitimate internal service dependencies. (3) Audit existing route-service configurations for suspicious redirect targets or proxy patterns, and disable or remove route-services not actively in use. Mitigations should be paired with a formal upgrade timeline, as they do not fully eliminate the vulnerability.