PatchTheCVECVE-2025-22246: Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.
13
Routine
LOW 3.0UPGRADEUPGRADE
CVE-2025-22246 is a low-severity flaw (CVSS 3.0) affecting cf-deployment, uaa release. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.0 (Low) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 90%) |
| CISA exploited list | No |
| Weakness | CWE-532 |
| Published | 2025-05-13 |
| Last modified | 2026-06-17 |
Publisher (CNA): VMware · Vendor: cloudfoundry
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
cloudfoundry cf-deployment UPGRADE
Affected: >= 45.1.0 and < 49.0.0
Fixed in: 49.0.0
Safe to downgrade to: a release before 45.1.0
1. Check installed version
apt-cache policy cf-deployment || rpm -q cf-deployment || cf-deployment --version
2. UPGRADE to 49.0.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade cf-deployment
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade cf-deployment
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 45.1.0 (Debian / Ubuntu)
apt-cache madison cf-deployment
sudo apt install cf-deployment=<VERSION_BEFORE_45.1.0>
sudo apt-mark hold cf-deployment
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list cf-deployment
sudo dnf downgrade cf-deployment-<VERSION_BEFORE_45.1.0>
sudo dnf versionlock add cf-deployment
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
cloudfoundry uaa release UPGRADE
Affected: >= 77.21.0 and < 77.32.0
Fixed in: 77.32.0
Safe to downgrade to: a release before 77.21.0
1. Check installed version
apt-cache policy uaa-release || rpm -q uaa-release || uaa-release --version
2. UPGRADE to 77.32.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade uaa-release
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade uaa-release
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 77.21.0 (Debian / Ubuntu)
apt-cache madison uaa-release
sudo apt install uaa-release=<VERSION_BEFORE_77.21.0>
sudo apt-mark hold uaa-release
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list uaa-release
sudo dnf downgrade uaa-release-<VERSION_BEFORE_77.21.0>
sudo dnf versionlock add uaa-release
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-22246?
cf-deployment: upgrade to 49.0.0; uaa release: upgrade to 77.32.0. Exact commands for each OS are on this page.
Is CVE-2025-22246 being exploited?
CVE-2025-22246 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-22246 affect?
CVE-2025-22246 affects cf-deployment, uaa release. Severity is low (CVSS 3.0). Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.
How urgent is CVE-2025-22246?
Priority 13/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-22726 MEDIUM 5.0 UPGRADE UPGRADE Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egr
- CVE-2026-22723 MEDIUM 6.5 UPGRADE UPGRADE Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cl
- CVE-2024-22279 MEDIUM 5.9 UPGRADE UPGRADE Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker