Cloudfoundry Foundation Uaa vulnerabilities

• cloud foundry uaa, cf-deployment +1 more DoS Vulnerability in UAA Related to JWKS URI Handling CVE-2026-59396 6.9 MediumOctober 30, 2026
• cloud foundry uaa, cf-deployment +1 more Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions CVE-2026-59357 6.5 MediumOctober 6, 2026
• cloud foundry uaa, cf-deployment +1 more UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type CVE-2026-59358 Public exploit 7.6 HighOctober 6, 2026
• cloud foundry foundation uaa, cloud foundry cf-deployment +1 more Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin CVE-2026-47839 9.2 CriticalSeptember 11, 2026
• cloud foundry uaa, cf-deployment +1 more Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise CVE-2026-59335 8.7 HighAugust 25, 2026
• cloud foundry cf-deployment, cloudfoundry foundation uaa +1 more LDAP StartTLS unconditionally disables hostname verification CVE-2026-47840 8.3 HighJuly 9, 2026
• cloud foundry cf deployment, uaa +1 more UAA accepts SAML Encrypted Assertions authentication bypass CVE-2026-41005 9.0 CriticalJune 11, 2026
• cloudfoundry foundation uaa, cloudfoundry cf-deployment, uaa-release +2 more UAA User Token Revocation logic error CVE-2026-22723 Fix available 6.5 MediumMarch 5, 2026
• cloud foundry uaa, cloudfoundry uaa release, cloud foundry cf deployment +1 more +3 more CVE-2025-22246 – UAA Private Key Exposure CVE-2025-22246 3.0 LowMay 13, 2025
• cloudfoundry foundation uaa UAA Failure to Remove Shadow User’s Access CVE-2024-38806 3.9 LowJuly 18, 2024
• cloud foundry uaa, cloudfoundry cf-deployment, user account and authentication +2 more UAA fails to check the state parameter when authenticating with external IDPs CVE-2020-5402 8.8 HighFebruary 27, 2020
• cloud foundry uaa, uaa release, pivotal software cloud foundry uaa +1 more +3 more UAA Privilege Escalation CVE-2018-15761 Fix available 9.9 CriticalNovember 19, 2018
• cloud foundry uaa, uaa release, pivotal software cloudfoundry uaa +1 more +3 more Cloud Foundry UAA MFA does not prevent brute force of MFA code CVE-2018-11082 6.6 MediumOctober 5, 2018