Cloud Foundry Routing Release CVE-2026-22726

The attacker must possess authenticated developer access to Cloud Foundry (PR:L) - specifically, the ability to create or modify routes and assign route-services to applications. The target Cloud Foundry instance must have the Gorouter component running with Routing Release versions 0.118.0-0.371.0. Route-services must be enabled in the platform configuration (a feature typically enabled by default). The internal network destination that the route-service redirects to must be reachable by the Gorouter host (reachable from the network segment where Gorouter runs, not from the application or external networks directly). No special configuration of the application itself is required; the bypass is performed entirely by the route-service. The vulnerability does not require user interaction, authentication to the target internal service, or non-default setup - it operates against default routing behavior once a malicious route-service is deployed. Exploitation is limited to attackers with platform developer credentials; external unauthenticated attackers cannot exploit this vulnerability directly.

CVSS 5.0 with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L indicates network-accessible exploitation by authenticated users (PR:L - requires login/developer role) with low complexity, no user interaction, and scope change to other systems. The attack vector is network and privileges required are low, reflecting the threat from internal developers rather than external attackers. However, several risk signals warrant careful analysis: (1) The confidentiality impact is marked as 'N' (None), yet the attack outcome explicitly enables access to internal HTTP services - this suggests the CVSS vector may not fully capture information disclosure risk from services exposed via the bypass. (2) Availability is listed as 'L' (Low), but the description implies potential lateral movement and internal reconnaissance rather than system unavailability. (3) Active exploitation status is not confirmed by CISA KEV or public POC references. (4) The threat is realistic but requires privileged access (PR:L), limiting the attacker pool to malicious developers with platform credentials. Real-world impact depends heavily on network topology: if internal services are segregated and route-services are heavily used, risk is elevated; if internal services are already exposed or route-service usage is restricted, real-world risk is moderate. The scope change (S:C) indicates the vulnerability can affect other applications and infrastructure beyond the attacker's own app, elevating priority. Recommendation: Prioritize patching in multi-tenant environments where developer access is broad; in restricted-access deployments, risk is lower but still material.

A malicious developer with Cloud Foundry platform credentials creates a route-service and assigns it to an application they control. The route-service is configured to intercept HTTP requests and forward them to an internal database server, cache service, or management interface that is normally unreachable from external networks or from other applications. When legitimate application traffic (or external requests routed through the application) passes through the route-service, the service extracts request/response data or probes the internal service for information. The developer can thus enumerate internal infrastructure, extract sensitive data, or map the network topology without triggering direct network access controls.