Is CVE-2026-40965 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40965 being exploited in the wild.

How severe is CVE-2026-40965?

Critical severity, with a CVSS score of 10, published 1 June 2026.

Which products and versions are affected?

Cloud Foundry UAA Release v76.12.0 through v78.12.0; Cloud Foundry CF Deployment v30.0.0 through v56.0.0.

Is there a fix for CVE-2026-40965?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40965 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-40965?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40965: Cloud Foundry UAA private key exposure in token_keys endpoint

CVE-2026-40965 · Severity: critical · CVSS 10 · Published 2026-06-01

Cloud Foundry User Authentication and Authorization (UAA) is a service used to manage identity and security tokens for cloud applications. A critical security flaw allows anyone on the network to view the private encryption keys used to sign security tokens when Elliptic Curve (EC) cryptography is used. An attacker could use these stolen keys to forge identity tokens, potentially gaining full administrative access to the cloud environment or impersonating any user.

Quick answers

Is CVE-2026-40965 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40965 being exploited in the wild.
How severe is CVE-2026-40965?: Critical severity, with a CVSS score of 10, published 1 June 2026.
Which products and versions are affected?: Cloud Foundry UAA Release v76.12.0 through v78.12.0; Cloud Foundry CF Deployment v30.0.0 through v56.0.0.
Is there a fix for CVE-2026-40965?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40965 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-40965?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Cloud Foundry UAA contains an information disclosure vulnerability in the public /token_keys endpoint. While this endpoint is intended to provide public key material for JWT verification, it incorrectly includes private key components when Elliptic Curve (EC) keys are configured for token signing. A remote, unauthenticated attacker can access this endpoint over the network to retrieve the private keys. With these keys, an attacker can sign fraudulent JSON Web Tokens (JWTs), leading to complete authentication bypass and privilege escalation. This issue does not affect RSA key configurations. Patches are available in uaa_release v78.13.0 and CF Deployment v56.1.0.

Affected products

Cloud Foundry UAA Release v76.12.0 through v78.12.0
Cloud Foundry CF Deployment v30.0.0 through v56.0.0

Timeline

2026-05-13: advisory: Initial vulnerability report published by Cloud Foundry Foundation
2026-06-01: disclosed: CVE published to NVD dataset

References

https://www.cloudfoundry.org/blog/cve-2026-40965-uaa-ec-private-key-disclosure/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.