Security Advisory

CVE-2026-59396 – DoS Vulnerability in UAA Related to JWKS URI Handling

Security Advisory

CVE-2026-59396 – DoS Vulnerability in UAA Related to JWKS URI Handling

by Cloud Foundry Foundation Security Team October 27, 2026

CVE-2026-59396 – DoS Vulnerability in UAA Related to JWKS URI Handling

Security Advisory

CVE-2026-59396 – DoS Vulnerability in UAA Related to JWKS URI Handling

by Cloud Foundry Foundation Security Team October 27, 2026

CVE-2026-59387 – broken access control restriction in Cloud Controller API

Security Advisory

CVE-2026-59387 – broken access control restriction in Cloud Controller API

by Cloud Foundry Foundation Security Team October 20, 2026

CVE-2026-59386 – credential exposure to space supporter

Security Advisory

CVE-2026-59386 – credential exposure to space supporter

by Cloud Foundry Foundation Security Team October 20, 2026

CVE-2026-59388 – Cloud Controller exposes secrets in audit log

Security Advisory

CVE-2026-59388 – Cloud Controller exposes secrets in audit log

by Cloud Foundry Foundation Security Team October 20, 2026

CVE-2026-59385 – Space Developer can extract space-scoped broker credentials

Security Advisory

CVE-2026-59385 – Space Developer can extract space-scoped broker credentials

by Cloud Foundry Foundation Security Team October 20, 2026

CVE-2026-59358 – UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type.

Security Advisory

CVE-2026-59358 – UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type.

by Cloud Foundry Foundation Security Team October 5, 2026

CVE-2026-59357 – Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions

Security Advisory

CVE-2026-59357 – Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions

by Cloud Foundry Foundation Security Team October 5, 2026

Cloud Foundry Build Infrastructure Exposed to Secret Exfiltration via pull_request_target Workflows

Security Advisory

Cloud Foundry Build Infrastructure Exposed to Secret Exfiltration via pull_request_target Workflows

by Cloud Foundry Foundation Security Team September 22, 2026

CVE-2026-47839 – Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

Security Advisory

CVE-2026-47839 – Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

by Cloud Foundry Foundation Security Team September 7, 2026

CVE-2026-41012- BOSH VSphere CPI Improper Cert Validation

Security Advisory

CVE-2026-41012- BOSH VSphere CPI Improper Cert Validation

by Cloud Foundry Foundation Security Team August 27, 2026

CVE-2026-59335 – UAA case insensitive check bypass

Security Advisory

CVE-2026-59335 – UAA case insensitive check bypass

by Cloud Foundry Foundation Security Team August 24, 2026