CVE-2026-40965: Cloud Foundry UAA versions v76

Synopsis

This is a private key exposure vulnerability in Cloud Foundry UAA versions v76.12.0 through v78.12.0. The server's public /token_keys endpoint, which is intended to serve only public key material for JWT verification, incorrectly returns EC (Elliptic Curve) private key components when EC keys are configured for JWT signing. An unauthenticated attacker reachable over the network can retrieve the private key and use it to forge arbitrary JWT tokens, gaining unauthorized access to any resource that trusts tokens signed by the affected UAA instance. Patched-image rebuilds at uaa_release v78.13.0 and CF Deployment v56.1.0 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable /token_keys endpoint is an HTTP service exposed over the network, so the attacker must be able to reach it remotely.

• AuthenticationNot required

  The endpoint is publicly accessible with no credentials required, matching PR:N in the CVSS vector.

• Victim interactionNot required

  No user action is needed; the attacker queries the endpoint directly without any social-engineering step, matching UI:N.

• Attack complexityDetail

  Exploit conditions are reliable and free of environmental dependencies (AC:L, AT:N); retrieving the private key is a single unauthenticated HTTP request with no race conditions or special timing required.

Blast Radius

• Attacker retrieves the EC private key used to sign JWT tokens for the UAA instance.
• Attacker forges arbitrary JWT tokens, impersonating any user or service account including platform administrators.
• Attacker gains full read and write access to Cloud Foundry platform resources and any application or service authorized by tokens issued from the compromised UAA (SC:H, SI:H).
• Service availability is partially degraded (VA:L, SA:L), but the primary risk is complete confidentiality and integrity compromise of the identity plane.