CVE-2026-40964: Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and platform component via minting a JWT that the cf-auth-proxy accepts as a valid logs

Synopsis

An authentication bypass vulnerability in the cf-auth-proxy component of Cloud Foundry Foundation allows an unauthenticated remote attacker to forge a JWT token that cf-auth-proxy accepts as a valid logs.admin credential. The component is reachable over the network and requires no prior authentication or user interaction. Successful exploitation gives the attacker read access to every application log and platform metric across all applications and infrastructure components. Note: The affected versions section references fix versions (log-cache_release v3.2.7), but no official fix release has been confirmed by the CNA at the time of publication; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the cf-auth-proxy service over the network; the component is internet- or network-exposed (AV:N).

• AuthenticationNot required

  No credentials or existing account are needed; the attacker bypasses authentication entirely by minting a forged JWT (PR:N).

• Victim interactionNot required

  The exploit requires no action from any user or operator; the attacker interacts directly with the service (UI:N).

• Attack complexityDetail

  Exploit conditions are reliable and free of environmental dependencies; no race conditions or special configurations are required to trigger the bypass (AC:L).

Blast Radius

• The attacker reads all application logs across every application hosted on the Cloud Foundry platform, potentially exposing credentials, session tokens, debug output, and business data written to stdout or stderr.
• The attacker reads all platform component metrics, revealing internal service topology, resource utilization patterns, and operational state that can be used for reconnaissance of the broader infrastructure.
• No data modification or service disruption is enabled by this vulnerability; impact is limited to confidentiality (I:N, A:N).