CVE-2017-8034: Cloudfoundry Capi-Release

Medium severity, CVSS 6.6. EPSS: 0.8% chance of exploitation in the next 30 days.

The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.

Affected products

• Cloudfoundry Capi-Release: up to and including 1.31.0
• Cloudfoundry Cf-Release: up to and including 266
• Cloudfoundry Routing-Release: up to and including 0.158.0

Published 2017-07-17. Last modified 2026-06-17.