CVE-2017-14389: Cloudfoundry Capi-Release

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover."

Affected products

• Cloudfoundry Capi-Release: before 1.45.0 (fixed in 1.45.0)
• Cloudfoundry Cf-Deployment: before 1.0.0 (fixed in 1.0.0)
• Cloudfoundry Cf-Release: before 280 (fixed in 280)

Published 2017-11-28. Last modified 2026-06-17.