2311 matches found
CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...
CVE-2026-81868
Steeltoe (open-source cloud-native application libraries) is vulnerable in Steeltoe.Security.Authorization.Certificate prior to version 4.3.0 . When using AddOrgAndSpacePolicies() and UseCertificateAuthorization(), the framework trusts the public certificate supplied in the X-Client-Cert request ...
EUVD-2026-81899
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...
CVE-2026-47839 - Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin | Cloud Foundry
High CVSS score: 9.2 Critical CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS score: 9.0 Critical CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Vendor CloudFoundry Foundation Versions Affected Severity is Critical unless otherwise noted. UAA – All versions through v77.30.0...
CVE-2026-59335
Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...
CVE-2026-59335 Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise
Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...
CVE-2026-59335
Cloud Foundry UAA is affected by an authorization bypass (CWE-178) in its Identity Zone Endpoint . The root cause is a mismatch between the application's case-sensitive zone identifier comparison and MySQL's case-insensitive default collation: an attacker holding only zones.write can reference th...
EUVD-2026-65466
Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...
PT-2026-81263
Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA affected versions not specified Description Improper handling of case sensitivity in the identity zone authorization check within the Identity Zone Endpoint allows a remote authenticated attacker with zones.write authority to...
CVE-2026-59335: Improper Handling of Case Sensitivity
Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...
CVE-2026-59335 - UAA case insensitive check bypass | Cloud Foundry
Severity CVSSv4.0 – 7.7 — CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSSv3.1 – 8.7 — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N Vendor CloudFoundry Foundation Versions Affected Severity is High unless otherwise noted. UAA All versions prior to v78.16.0 CF Deployment All...
CVE-2026-47827
Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities...
CVE-2026-47827 CVE-2026-47827 – BOSH CLI Powershell Injection
Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities...
CVE-2026-47827
CVE-2026-47827 is a command injection vulnerability in the BOSH CLI tool (Cloud Foundry) on Windows , allowing a remote attacker to execute arbitrary shell commands via PowerShell injection. All versions prior to v2.840.0 are affected. The vulnerability requires an adjacent network position and h...
EUVD-2026-63874
Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities...
CVE-2026-47827 - BOSH CLI Powershell Injection | Cloud Foundry
HIGH CVSSv4: High 7.7 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSSv3: High 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Vendor CloudFoundry Foundation Versions Affected Severity is HIGH unless otherwise noted. BOSH CLI tool – All versions v2.840.0 Description Command...
ANT-2026-S8PHCV74 · cloudfoundry/uaa · auth_bypass
auth-bypass medium Severity Claude high · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-S8PHCV74: DenyAccessToUaaAdvice case-sensitive check bypassed on MySQL: zones.write overwrites syste...
Arbitrary Command Injection
Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the ssh process. An attacker can execute arbitrary commands on the operator's workstation by injecting malicious OpenSSH options when the operator runs non-interactive SSH commands. Remediation Upgrade...
CVE-2026-47840
A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselv...
