Skip to content
OpenAdvisories

Product · Cloud Foundry

CF Deployment

27 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-47839

    Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

    A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider…

    Cloud Foundry CF Deployment UAA
  • Critical 9.0
    CVE-2026-41005

    UAA accepts SAML Encrypted Assertions authentication bypass

    Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (authenticity) in two SAML flows: the OAuth 2.0 SAML2 bearer grant (token endpoint) and browser SSO (A…

    Cloud Foundry CF Deployment UAA
  • Critical 10.0
    CVE-2026-40965

    Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vu…

    Cloud Foundry CF Deployment UAA Release