EUVD-2026-76026
GHSA-9wp3-mffv-5vr4
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote OIDC user needs no UAA privileges (PR:N) but exploitation depends on a specific non-default AS_SCOPES+wildcard configuration (AC:H); uaa.admin grants full C/I/A of the UAA control plane.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.
AnalysisAI
Privilege escalation in Cloud Foundry UAA (User Account and Authentication server) lets users who authenticate via a federated OIDC provider obtain the powerful uaa.admin scope even though operators intended to restrict that provider using the externalGroupsWhitelist configuration. The flaw manifests only when an OIDC identity provider is configured with groupMappingMode: AS_SCOPES together with a wildcard (*) externalGroupsWhitelist entry, causing the wildcard to grant all mapped external groups as scopes - including uaa.admin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target UAA to have a federated OIDC identity provider configured with groupMappingMode: AS_SCOPES AND a wildcard ('*') entry in that provider's externalGroupsWhitelist - this is the explicit prerequisite stated in the description and is not the default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 9.2 reflects network attack vector (AV:N), no privileges on UAA itself (PR:N), no user interaction (UI:N), and full compromise of confidentiality, integrity and availability of the UAA control plane (VC:H/VI:H/VA:H) - obtaining uaa.admin effectively grants control of identity and token issuance across the foundation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Cloud Foundry advisory (https://www.cloudfoundry.org/blog/cve-2026-47839-federated-oidc-users-can-bypass-externalgroupswhitelist-to-gain-uaa-admin/) and upgrade UAA / cf-deployment to the patched release it specifies; no exact fixed version is included in the supplied data, so the patched version should be confirmed against that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Cloud Foundry UAA OIDC configuration to determine whether you have groupMappingMode: AS_SCOPES combined with wildcard (*) in externalGroupsWhitelist-if both are present, you face immediate critical risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cf Deployment
View allPrivate key disclosure in Cloud Foundry UAA versions v76.12.0 through v78.12.0 allows unauthenticated remote attackers t
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fet
Adversary-in-the-middle credential theft and privilege escalation affects Cloud Foundry UAA (User Account and Authentica
Authentication bypass in Cloud Foundry UAA (User Account and Authentication) versions 2.0.0 through 78.13.0 allows remot
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also t
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being
Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. Rated high s
Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. Rated high severity
In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 28
Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. Rated high severity (CVSS 8.
Privilege escalation in Cloud Foundry smb-volume-release (prior to v3.60.0) and CF Deployment (prior to v56.0.0) lets a
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override othe
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today