What is the CVSS score of CVE-2026-40964?

CVE-2026-40964 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Cloud Foundry log-cache are affected by CVE-2026-40964?

Cloud Foundry deployments running log-cache_release v3.2.6 and earlier are vulnerable to an unauthenticated authentication bypass in cf-auth-proxy, permitting attackers to read all application logs…

How to fix or mitigate CVE-2026-40964?

24 hours: Identify and inventory all Cloud Foundry environments running log-cache_release v3.2.6 or earlier; implement immediate network-level isolation of cf-auth-proxy to trusted networks only. 7 days: Deploy Web Application Firewall rules to restrict and monitor cf-auth-proxy access; establish detailed audit logging of all authentication attempts. 30 days: Actively monitor VMware Cloud Foundry security advisories for patch release; prepare upgrade deployment plan for execution within 72 hours of patch availability.

Cloud Foundry log-cache CVE-2026-40964

EUVD-2026-33765 HIGH

Improper Authentication (CWE-287)

2026-06-01 vmware

GHSA-9cjf-w9mw-93r3

Authentication Bypass Log Cache Release Cf Deployment

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 22:16 vuln.today

DescriptionCVE.org

Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and platform component via minting a JWT that the cf-auth-proxy accepts as a valid logs.admin token.

Affected versions:

log-cache_release: all versions through v3.2.6 (inclusive); fixed in v3.2.7 or later
CF Deployment: all versions through v55.?.0 (inclusive); fixed in v55.?.0 or later (bundles log-cache_release v3.2.7)

AnalysisAI

Authentication bypass in Cloud Foundry's cf-auth-proxy (log-cache_release through v3.2.6) lets a remote unauthenticated attacker mint a JWT that the proxy accepts as a valid logs.admin token, granting read access to every application and platform-component log and metric across the foundation. CVSS 7.5 with AV:N/AC:L/PR:N reflects trivially-reachable, network-based exploitation; no public exploit has been identified at time of analysis, but the CVSS vector includes E:P indicating proof-of-concept maturity per the issuing CNA (VMware).

Technical ContextAI

log-cache is the Cloud Foundry subsystem that aggregates application and platform logs and metrics for query via the Loggregator/log-cache API. cf-auth-proxy sits in front of log-cache and is responsible for validating UAA-issued JWTs and enforcing the logs.admin scope before forwarding requests. The CWE-287 (Improper Authentication) root cause means the proxy's token validation logic fails to correctly verify a property of the JWT - typically signature, issuer, audience, or scope claims - allowing an attacker-crafted token to pass as an authentic admin credential without the attacker possessing the UAA signing key or a legitimate admin grant. The affected CPEs are cpe:2.3:a:cloud_foundry_foundation:log-cache_release and cpe:2.3:a:cloud_foundry_foundation:cf_deployment, confirming this is a platform-level component bundled into the broader CF Deployment release.

RemediationAI

Vendor-released patch: log-cache_release v3.2.7 (bundled in the corresponding fixed CF Deployment release). Upgrade log-cache_release to v3.2.7 or later, or roll out the fixed CF Deployment build that contains it, following the Cloud Foundry advisory at https://www.cloudfoundry.org/blog/cve-2026-40964-read-access-to-cf-logs/. Until the upgrade is applied, restrict network exposure of the cf-auth-proxy / log-cache gateway endpoint to operator and platform-internal CIDRs via security groups or an upstream reverse proxy ACL - this is the highest-leverage compensating control because the vulnerability requires reaching the proxy. Rotate any UAA signing keys and JWT secrets if there is any suspicion the issuing key material was probed, and audit log-cache access logs for anomalous unauthenticated or unexpected admin-scoped reads; note that key rotation forces re-issuance of legitimate operator tokens and brief operator workflow disruption. Avoid disabling cf-auth-proxy outright, as that removes authentication entirely.