CVE-2026-59358

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-59358 Write-up: https://abraxaslabs.tech/research/cve-2026-59358 CVE-2026-59358 Class: Privilege leftover Reach: Remote Cloud Foundry UAA v79.6.0 - VMware by Broadcom / Cloud Foundry Foundation I am...

CVE-2026-59386

A flaw was found in Cloud Foundry Controller CAPI. An authenticated user with SpaceSupporter permissions can improperly modify an application's start command or buildpack configuration, operations that should require elevated privileges. This privilege escalation can allow the unauthorized...

CVE-2026-59387: Cloud Foundry: The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/…

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/dropletcompleted and...

CVE-2026-59385: Cloud Foundry: A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials,…

A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making thi...

CVE-2026-59386: Cloud Foundry: A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper…

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks...

CVE-2026-59396: Cloud Foundry: A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism

A denial-of-service vulnerability exists in UAA's privatekeyjwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites write access to clien...

CVE-2026-59388 - Cloud Controller exposes secrets in audit log | Cloud Foundry

Severity High CVSS score: 6.5 Medium CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.248.0 inclusive Description Credentials for custom buildpacks leaked into audit events of type...

CVE-2026-59385 - Space Developer can extract space-scoped broker credentials | Cloud Foundry

Severity High CVSS score: 2.7 Low CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.247.0 inclusive Description A SpaceDeveloper could configure the url of a space-scoped broker without changin...

CVE-2026-59386 - credential exposure to space supporter | Cloud Foundry

Severity Medium CVSS score: 6.4 Medium CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.247.0 inclusive Description A SpaceSupporter could change the start command and buildpack of an...

CVE-2026-59387 - broken access control restriction in Cloud Controller API | Cloud Foundry

Severity High CVSS score: 8.8 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.245.0 inclusive Description The Nginx routing configuration for Cloud Controller blocks unauthenticated acce...

Exploit for CVE-2026-59358

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-59358

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2026-59357

Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...

CVE-2026-59357 Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions

Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...

EUVD-2026-92989

Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...

CVE-2026-59357

Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...

CVE-2026-59357 Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions

Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...

CVE-2026-59357

Cloud Foundry UAA versions v4.5.0 to v79.6.0 (inclusive) are vulnerable to JWT injection due to insufficient verification of data authenticity (CWE-345 ) in the external OIDC login callback. This issue occurs specifically in "self-UAA" configurations where the OIDC identity provider issuer matche...

CVE-2026-59357 Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions

Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...

CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...