Which versions of Cloud Foundry UAA are affected by CVE-2026-40965?

Cloud Foundry UAA (versions 76.12.0-78.12.0) improperly exposes private encryption keys via an unauthenticated endpoint, allowing attackers to forge authentication credentials and impersonate any…. A patch is available.

How to fix or mitigate CVE-2026-40965?

Within 24 hours: Identify all Cloud Foundry UAA instances running versions v76.12.0 through v78.12.0; implement network access controls restricting the /token_keys endpoint to authorized internal services only; enable detailed logging of all /token_keys endpoint requests. Within 7 days: Deploy Web Application Firewall rules or reverse proxy authentication to prevent unauthenticated access to /token_keys; contact Cloud Foundry vendor to confirm patched version timeline and begin pre-testing of upgrade procedures. Within 30 days: Upgrade to a patched Cloud Foundry UAA version once released by vendor; validate authentication functionality post-upgrade; audit historical logs for evidence of exploitation; prepare cryptographic key rotation procedures if compromise is confirmed.

Cloud Foundry UAA CVE-2026-40965

Q: What is the CVSS score of CVE-2026-40965?

CVE-2026-40965 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33817 CRITICAL

Information Exposure (CWE-200)

2026-06-01 vmware

GHSA-qc5f-2h9q-7m2g

Information Disclosure Uaa Release Cf Deployment

10.0

CVSS 4.0 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 01, 2026 - 23:02 EUVD

Analysis Generated

Jun 01, 2026 - 22:15 vuln.today

DescriptionCVE.org

Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed through the public /token_keys endpoint. This endpoint is designed to provide public key material for JWT token verification but incorrectly exposes private key components for EC keys. The vulnerability affects deployments using EC keys for JWT token signing. The vulnerability does not affect RSA key configurations, only deployments using EC keys for JWT signing.

Affected versions:

uaa_release: v76.12.0 through v78.12.0 (inclusive); fixed in v78.13.0 or later
CF Deployment: v30.0.0 through v56.0.0 (inclusive); fixed in v56.1.0 or later (bundles uaa_release v78.13.0)

AnalysisAI

Private key disclosure in Cloud Foundry UAA versions v76.12.0 through v78.12.0 allows unauthenticated remote attackers to retrieve Elliptic Curve (EC) private key material from the public /token_keys endpoint, which is supposed to expose only public verification keys. With the leaked private keys, attackers can forge arbitrary JWTs and impersonate any UAA-authenticated identity across the platform. No public exploit identified at time of analysis, though the CVSS 10.0 score and trivial reproduction step (a single unauthenticated HTTP GET) make weaponization straightforward once the issue is widely known.

Technical ContextAI

UAA (User Account and Authentication) is the OAuth2/OpenID Connect identity server for Cloud Foundry platforms, issuing and validating JWT access tokens for the entire platform. The /token_keys endpoint follows the JWK Set (RFC 7517) pattern and is intentionally public so that resource servers can fetch the public keys needed to verify JWT signatures. The bug is a CWE-200 (Exposure of Sensitive Information) where UAA's JWK serialization for EC keys incorrectly includes the private 'd' parameter alongside the public 'x' and 'y' coordinates; RSA keys are not affected because their serialization path correctly omits private components. Affected CPEs are cpe:2.3:a:cloud_foundry_foundation:uaa_release and cpe:2.3:a:cloud_foundry_foundation:cf_deployment.

RemediationAI

Vendor-released patch: upgrade uaa_release to v78.13.0 or later, or upgrade cf-deployment to v56.1.0 or later (which bundles the fixed UAA), per https://www.cloudfoundry.org/blog/cve-2026-40965-uaa-ec-private-key-disclosure/. Because the private key material has been served publicly for the lifetime of the vulnerable deployment, patching alone is not sufficient: operators must rotate all EC JWT signing keys after upgrading and force re-issuance of outstanding tokens, since any token signed before rotation should be considered forgeable. As an immediate pre-upgrade workaround where rapid patching is not possible, switch UAA's JWT signing configuration from EC to RSA keys (the bug does not affect RSA serialization), accepting the operational cost of a key-type migration and token invalidation; alternatively, restrict network access to the /token_keys endpoint to trusted resource servers only, with the trade-off that any legitimate client relying on dynamic JWKS discovery will break.