Cloud Foundry Bits Service versions prior to 2.18.0 includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key allowing them complete read and write access to the the Bits Service storage.