Quick answers
- Is CVE-2026-59358 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59358 being exploited in the wild.
- How severe is CVE-2026-59358?
- Informational severity, published 6 October 2026.
- Which products and versions are affected?
- Cloud Foundry UAA.
- Is there a fix for CVE-2026-59358?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-59358 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-59358?
- Check whether you run Cloud Foundry UAA. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The OAuth token endpoint in Cloud Foundry UAA fails to properly validate that Bearer credentials supplied during client authentication are actually client secrets or valid client authentication methods. Instead, it accepts any valid access token matching the requested client_id. An attacker holding a normal user access token (with only uaa.user scope) can replay it as Bearer authentication on a client_credentials grant request to obtain a full client credentials token with all the client's authorities, including clients.write. Exploitation requires the target client to be configured for both public authorization_code+PKCE flows and client_credentials grants—a non-default configuration.
Affected products
- Cloud Foundry UAA
Timeline
- 2026-10-06: disclosed