CloudFoundry Foundation UAA vulnerabilities (CVE)

CVE records published for CloudFoundry Foundation UAA, newest first. Follow to get an email when a new one appears.

2 results

7.5High

CVE-2026-47840 4 months ago

LDAP StartTLS unconditionally disables hostname verification

CloudFoundry Foundation UAA; CloudFoundry Foundation Cf-deployment

A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged…

6.5Medium

CVE-2026-22723 8 months ago

UAA User Token Revocation logic error

Cloudfoundry Foundation UAA

Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.