# CVE-2026-40965: Cloud Foundry UAA private key exposure in token_keys endpoint

Source: https://junglewise.ai/threats/cve-2026-40965-cloud-foundry-uaa-private-key-exposure-in-token-keys-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-40965 · Severity: critical · CVSS 10 · Published 2026-06-01

Cloud Foundry User Authentication and Authorization (UAA) is a service used to manage identity and security tokens for cloud applications. A critical security flaw allows anyone on the network to view the private encryption keys used to sign security tokens when Elliptic Curve (EC) cryptography is used. An attacker could use these stolen keys to forge identity tokens, potentially gaining full administrative access to the cloud environment or impersonating any user.

## Quick answers

**Is CVE-2026-40965 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40965 being exploited in the wild.

**How severe is CVE-2026-40965?** Critical severity, with a CVSS score of 10, published 1 June 2026.

**Which products and versions are affected?** Cloud Foundry UAA Release v76.12.0 through v78.12.0; Cloud Foundry CF Deployment v30.0.0 through v56.0.0.

**Is there a fix for CVE-2026-40965?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40965 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-40965?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Cloud Foundry UAA contains an information disclosure vulnerability in the public /token_keys endpoint. While this endpoint is intended to provide public key material for JWT verification, it incorrectly includes private key components when Elliptic Curve (EC) keys are configured for token signing. A remote, unauthenticated attacker can access this endpoint over the network to retrieve the private keys. With these keys, an attacker can sign fraudulent JSON Web Tokens (JWTs), leading to complete authentication bypass and privilege escalation. This issue does not affect RSA key configurations. Patches are available in uaa_release v78.13.0 and CF Deployment v56.1.0.

## Affected products

- Cloud Foundry UAA Release v76.12.0 through v78.12.0
- Cloud Foundry CF Deployment v30.0.0 through v56.0.0

## Timeline

- 2026-05-13: advisory: Initial vulnerability report published by Cloud Foundry Foundation
- 2026-06-01: disclosed: CVE published to NVD dataset

## References

- [https://www.cloudfoundry.org/blog/cve-2026-40965-uaa-ec-private-key-disclosure/](https://www.cloudfoundry.org/blog/cve-2026-40965-uaa-ec-private-key-disclosure/)