Executive brief
Cloud Foundry's User Account and Authentication (UAA) service manages identity and access control for Cloud Foundry deployments. A vulnerability allows users logging in through a federated OpenID Connect (OIDC) provider to gain administrative privileges (uaa.admin scope) even when operators have configured restrictions to prevent this. An attacker with access to a federated OIDC provider can exploit this to gain full administrative access to the Cloud Foundry system.
Technical details
This is an authorization bypass vulnerability in Cloud Foundry UAA's OIDC federation logic. The root cause is improper scope validation when an OIDC identity provider is configured with groupMappingMode: AS_SCOPES and the operator has set a wildcard entry in externalGroupsWhitelist. An authenticated user from the federated OIDC provider (network-reachable attack, federation required) can bypass the intended externalGroupsWhitelist restrictions and obtain the uaa.admin scope, leading to full administrative privilege escalation. The vulnerability affects UAA through version 77.30.0 and cf-deployment through version 48.9.0; patches are available in UAA v77.31.0+ and cf-deployment v48.10.0+.
Affected products
- Cloud Foundry UAA through v77.30.0
- Cloud Foundry cf-deployment through v48.9.0
Timeline
- 2026-09-07: disclosed: Vulnerability responsibly disclosed
- 2026-09-11: advisory: Security advisory published
- 2026-09-11: patched: Patches available: UAA v77.31.0+, cf-deployment v48.10.0+