CVE-2016-0896: Pivotal Software Cloud Foundry Elastic Runtime

High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days.

Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address.

Affected products

• Pivotal Software Cloud Foundry Elastic Runtime: up to and including 1.6.33; version 1.7.0 only; version 1.7.1 only; version 1.7.2 only; version 1.7.3 only; version 1.7.4 only; …

Published 2016-09-18. Last modified 2026-06-17.