Cloud Foundry CVE-2026-22734

Exploitation requires SAML 2.0 bearer assertion grant type to be enabled for at least one OAuth client registered in the target UAA instance. This is configured per-client via the 'authorized_grant_types' field and is NOT enabled by default for all clients - it must be explicitly configured during client registration or updates, typically when integrating enterprise SAML identity providers for SSO. Organizations not using SAML-based authentication workflows or those using only SAML Web SSO (redirect-based flow) rather than bearer assertion grants are not exploitable despite running vulnerable UAA versions. The attack requires network connectivity to the UAA token endpoint (typically HTTPS on port 443 or 8443), which is intentionally internet-facing in most deployments to support authentication flows. No user interaction is required (UI:N), no pre-existing authentication is needed (PR:N), and attack complexity is low (AC:L) because the SAML XML structure is well-documented and no brute-forcing or race conditions are involved. The vulnerability is limited to environments where SAML bearer assertions are an active authentication method, but within those environments, exploitation is trivial against default configurations of affected UAA versions.

This represents a critical real-world risk despite no confirmed active exploitation. The CVSS 8.6 score reflects severe impact: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and changed scope (S:C) allowing lateral movement to all UAA-protected services. High confidentiality impact (C:H) is accurate as attackers gain complete authentication bypass, though integrity (I:N) and availability (A:N) are rated none because the attack obtains tokens rather than modifying data directly - however, once authenticated as arbitrary users, attackers possess full integrity impact on downstream systems not reflected in this score. No EPSS data provided, but the combination of network exposure, zero authentication requirements, and public technical disclosure in the vendor blog creates high exploitation probability. SSVC assessment: exploitation status is unknown (no public exploit confirmed), but the attack is highly automatable given the straightforward nature of crafting unsigned SAML assertions, and technical impact is total for authentication systems. The limiting factor is the specific configuration requirement (SAML 2.0 bearer assertions enabled), which is not default for all deployments but is common in enterprise SSO integrations. Organizations using UAA with SAML-based identity providers face immediate critical risk, while those not using SAML bearer assertions are unaffected despite running vulnerable code. Vendor has publicly disclosed full technical details, significantly lowering the barrier to exploitation development.

An attacker identifies a Cloud Foundry deployment with UAA accessible over the network and determines through reconnaissance that SAML 2.0 bearer assertions are enabled for at least one OAuth client (discoverable via UAA's client metadata endpoints or through documentation of the target's SSO integration). The attacker crafts an unsigned SAML 2.0 assertion XML document claiming the identity of a privileged user (such as a platform administrator), setting the NameID to the target username and including appropriate audience and validity timestamps. The attacker submits this forged assertion to the UAA token endpoint using the SAML bearer grant type, and the vulnerable UAA accepts the unsigned assertion without validation, issuing a valid OAuth access token for the impersonated user. With this token, the attacker authenticates to any Cloud Foundry service protected by UAA, including Cloud Controller API, achieving full platform administration privileges to deploy applications, access sensitive data, or pivot to underlying infrastructure.