How severe is CVE-2025-22246?

CVE-2025-22246 has a CVSS 3.x base score of 3.0, rated low severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-22246 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-22246?

CVE-2025-22246 primarily affects Cloudfoundry Cf-deployment. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-22246?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-22246 have an EU (EUVD) identifier?

Yes. CVE-2025-22246 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-14361.

When was CVE-2025-22246 published?

CVE-2025-22246 was published on 2025-05-13 and last updated on 2026-06-17.

CVE-2025-22246

CVE-2025-22246 is a low-severity vulnerability in Cloudfoundry Cf-deployment with a CVSS 3.x base score of 3.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-532.

Key facts

Severity: Low (CVSS 3.x base score 3.0)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-14361
Weakness: CWE-532
Affected product: Cloudfoundry Cf-deployment
Published: 2025-05-13
Last modified: 2026-06-17

Description

Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.

Frequently asked questions

What is CVE-2025-22246?: Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.
How severe is CVE-2025-22246?: CVE-2025-22246 has a CVSS 3.x base score of 3.0, rated low severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-22246 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-22246?: CVE-2025-22246 primarily affects Cloudfoundry Cf-deployment. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-22246?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-22246 have an EU (EUVD) identifier?: Yes. CVE-2025-22246 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-14361.
When was CVE-2025-22246 published?: CVE-2025-22246 was published on 2025-05-13 and last updated on 2026-06-17.

References

https://www.cloudfoundry.org/blog/cve-2025-22246-uaa-private-key-exposure/

Affected products (2)

cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:uaa_release:*:*:*:*:*:*:*:*

More vulnerabilities in Cloudfoundry Cf-deployment

CVE-2019-3801 — Critical (CVSS 9.8): Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to…
CVE-2022-31733 — Critical (CVSS 9.1): Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are…
CVE-2020-5417 — High (CVSS 8.8): Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also…
CVE-2020-5402 — High (CVSS 8.8): In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not…
CVE-2019-11283 — High (CVSS 8.8): Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote…
CVE-2018-1191 — High (CVSS 8.8): Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access…

All CVEs affecting Cloudfoundry Cf-deployment →

Other CWE-532 (Insertion of Sensitive Information into Log File) vulnerabilities

CVE-2022-36407 — Critical (CVSS 9.9): Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage Platform, Hitachi Virtual…
CVE-2023-40029 — Critical (CVSS 9.9): Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively…
CVE-2021-32724 — Critical (CVSS 9.9): check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the…
CVE-2026-49200 — Critical (CVSS 9.8): The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file…
CVE-2026-22778 — Critical (CVSS 9.8): vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid…
CVE-2025-11008 — Critical (CVSS 9.8): The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…

Browse all CWE-532 (Insertion of Sensitive Information into Log File) vulnerabilities →