Cloud Foundry UAA CVE-2026-59335

Exploitation requires the attacker to hold the zones.write authority within the Cloud Foundry UAA deployment - this is an elevated but sub-administrative OAuth2 scope that must be explicitly granted and is not assigned by default to ordinary users. The UAA deployment must use MySQL as its backing store with a case-insensitive default collation; the description explicitly states that PostgreSQL and HSQLDB backends are not vulnerable regardless of configuration. The attacker must supply the system zone identifier in any non-lowercase form (e.g., 'UAA', 'Uaa') in both the request path and request body of an Identity Zone write operation. Exploitation is limited by: (1) the requirement for the zones.write authority, which should be restricted to trusted operators and is not default-granted; (2) the MySQL backend requirement; and (3) the dependency on MySQL's default case-insensitive collation - deployments that have explicitly set a binary collation on the zone identifier column are also not affected. Network access to the UAA API endpoint is required (AV:N per CVSS), but no additional complexity, race condition, or chained vulnerability is needed once these prerequisites are met.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, score 8.7) accurately reflects the attack profile: network-reachable, low complexity once prerequisites are met, but gated behind the zones.write authority (PR:H). The Changed Scope (S:C) is the most consequential metric - compromising the UAA system zone's JWT signing key cascades trust across every Cloud Foundry service that accepts UAA-issued tokens, turning an identity-layer breach into a full deployment compromise. No EPSS probability data was provided, so exploitation likelihood cannot be independently quantified. The CVE is not listed in CISA KEV and no POC has been publicly identified at time of analysis, meaning active exploitation is unconfirmed. Despite the PR:H gating, the attack complexity once zones.write is held is genuinely low (AC:L) - the bypass is a trivial case change requiring no race condition, heap spray, or chained vulnerability. The MySQL-specific collation constraint meaningfully segments the affected population: operators on PostgreSQL or HSQLDB face no exposure. The 'Information Disclosure' tag in the source intelligence materially understates the impact - this is an integrity compromise enabling wholesale identity takeover, not a passive data leak.

An attacker who has been granted zones.write authority on a MySQL-backed Cloud Foundry deployment sends an HTTP PUT request to the UAA Identity Zone Endpoint, specifying the zone identifier as 'UAA' (or any non-lowercase variant) in both the URL path and the request body JSON. The authorization layer accepts the request because 'UAA' does not equal 'uaa' in its case-sensitive check, while MySQL resolves 'UAA' to the actual system zone row under its default collation. The attacker overwrites the system zone's JWT signing key configuration with attacker-controlled key material, then mints arbitrary JWTs claiming the admin client and administrator scopes, gaining full control over the UAA instance and every Cloud Foundry service that trusts its tokens.