EUVD-2026-65466
GHSA-m647-7qf2-2rmg
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Network-reachable UAA API; AC:L because the bypass is a trivial case change requiring no complexity; PR:H because zones.write is an explicitly granted elevated authority; S:C because JWT key compromise cascades to all CF-trusting services with no availability impact described.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
3DescriptionCVE.org
Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to the privileged uaa (system) identity zone, by referring to the zone identifier in a non-lowercase form (e.g. UAA) in the request path and body. The authorization layer performs a case-sensitive comparison against the system zone identifier, while the underlying MySQL persistence layer resolves identifiers case-insensitively under its default collation, so the request is authorized incorrectly and is then resolved against the real system zone record. This allows the attacker to overwrite the system zone's JWT signing key with attacker-controlled key material, forge JWTs claiming the admin client and administrator scopes, and fully compromise UAA and any Cloud Foundry deployment that trusts it. This issue only affects UAA deployments backed by MySQL using its default collation; PostgreSQL and HSQLDB backends are not affected.
AnalysisAI
JWT signing key replacement in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to fully compromise the entire Cloud Foundry deployment. By exploiting a case sensitivity mismatch between the authorization layer (which performs a case-sensitive string comparison against the literal 'uaa' identifier) and the MySQL persistence layer (which resolves identifiers case-insensitively under its default collation), an attacker submitting 'UAA' or 'Uaa' bypasses the privilege check while the database silently resolves the request against the real system zone record. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold the zones.write authority within the Cloud Foundry UAA deployment - this is an elevated but sub-administrative OAuth2 scope that must be explicitly granted and is not assigned by default to ordinary users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, score 8.7) accurately reflects the attack profile: network-reachable, low complexity once prerequisites are met, but gated behind the zones.write authority (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patched UAA release identified in the vendor advisory at https://www.cloudfoundry.org/blog/cve-2026-59335-uaa-case-insensitive-check-bypass/; an exact fixed version number is not independently confirmed from available data and must be obtained from that source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit and minimize zones.write permission grants to essential service accounts only, and implement network-layer restrictions on UAA API access if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today