Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and earlier, and CF Deployment v54.9.0 and earlier expose a missing authentication weakness (CWE‑306). An attacker who has bypassed the firewall could replace droplets, effectively changing application code and gaining unauthorized access to secure application data. This permits data exfiltration and could be used to execute arbitrary code within the affected environment.

The vulnerability affects Cloudfoundry:Cloud Foundry products, specifically Capi Release versions up to 1.226.0 and CF Deployment versions up to v54.9.0 on all platforms. Users of these releases should verify whether their deployment matches or precedes these versions.

The CVSS v3 score is 7.5, indicating high severity. Exploit probability (EPSS) is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting it may not yet be widely exploited. The likely attack vector requires an attacker to have already bypassed the external firewall to reach the internal network, after which the unprotected endpoints allow direct droplet replacement. Given the potential for remote code execution and data exposure, the risk is considered significant if the firewall is compromised.