Quick answers
- Is CVE-2026-47839 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-47839 being exploited in the wild.
- How severe is CVE-2026-47839?
- Informational severity, with a CVSS score of 9.2, published 11 September 2026.
- Which products and versions are affected?
- Cloud Foundry UAA through v77.30.0.
- Is there a fix for CVE-2026-47839?
- A patch was published on 2026-09-11: Patches available: UAA v77.31.0+, cf-deployment v48.10.0+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-47839 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-47839?
- Check whether you run Cloud Foundry UAA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an authorization bypass vulnerability in Cloud Foundry UAA's OIDC federation logic. The root cause is improper scope validation when an OIDC identity provider is configured with groupMappingMode: AS_SCOPES and the operator has set a wildcard entry in externalGroupsWhitelist. An authenticated user from the federated OIDC provider (network-reachable attack, federation required) can bypass the intended externalGroupsWhitelist restrictions and obtain the uaa.admin scope, leading to full administrative privilege escalation. The vulnerability affects UAA through version 77.30.0 and cf-deployment through version 48.9.0; patches are available in UAA v77.31.0+ and cf-deployment v48.10.0+.
Affected products
- Cloud Foundry UAA through v77.30.0
- Cloud Foundry cf-deployment through v48.9.0
Timeline
- 2026-09-07: disclosed: Vulnerability responsibly disclosed
- 2026-09-11: advisory: Security advisory published
- 2026-09-11: patched: Patches available: UAA v77.31.0+, cf-deployment v48.10.0+