CVE-2026-22726: Route Services Firewall Bypass
Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks reachable by the Gorouter, which may not have previously had direct access from outside networks, or from the application. Routing release: affected from v0.118.0 through v0.371.0 (inclusive); upgrade to v0.372.0 or greater. CF Deployment: affected from v0.0.2 through v54.14.0 (inclusive); upgrade to v55.0.0 or greater (includes routingrelease v0.372.0).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22726?
CVE-2026-22726 is considered a high-severity vulnerability due to its potential for bypassing egress rules.
How do I fix CVE-2026-22726?
To fix CVE-2026-22726, ensure that your Cloud Foundry routing-release and cf-deployment versions are updated to the latest secure releases.
What are the affected versions for CVE-2026-22726?
CVE-2026-22726 affects Cloud Foundry routing-release versions between 0.118.0 and 0.371.0, and cf-deployment versions between 0.0.2 and 54.14.0.
What impact does CVE-2026-22726 have on applications?
CVE-2026-22726 allows unauthorized routing of app traffic to external destinations, which can lead to data exfiltration or other malicious activities.
Who can exploit CVE-2026-22726?
CVE-2026-22726 can be exploited by a malicious developer with access to the Cloud Foundry environment.