CVE-2026-59335— Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise
Quick assessment
Affected
Cloud Foundry UAA
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cloud Foundry UAA是美国Cloud Foundry基金会的一款身份认证与授权管理平台。 Cloud Foundry UAA 78.16.0之前版本和Cloud Foundry cf-deployment 57.0.0之前版本存在输入验证错误漏洞，该漏洞源于身份区域授权检查对大小写敏感性处理不当，仅持有zones.write权限的远程认证攻击者可通过在请求路径和请求体中引用非小写形式的区域标识符绕过授权限制，覆盖JWT签名密钥并伪造JWT，从而完全控制UAA及信任它的Cloud Foundr
Possible ATT&CK Techniques 3 AI
T1552 · Unsecured Credentials T1078 · Valid Accounts T1556 · Modify Authentication ProcessAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cloud Foundry | cf-deployment | < 57.0.0 |
affected |
57.0.0 |
unaffected | ||
| Cloud Foundry | UAA | < 78.16.0 |
affected |
78.16.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-59335
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise
Source: CVE Program / CVE List V5
Vulnerability Description
Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to the privileged uaa (system) identity zone, by referring to the zone identifier in a non-lowercase form (e.g. UAA) in the request path and body. The authorization layer performs a case-sensitive comparison against the system zone identifier, while the underlying MySQL persistence layer resolves identifiers case-insensitively under its default collation, so the request is authorized incorrectly and is then resolved against the real system zone record. This allows the attacker to overwrite the system zone's JWT signing key with attacker-controlled key material, forge JWTs claiming the admin client and administrator scopes, and fully compromise UAA and any Cloud Foundry deployment that trusts it. This issue only affects UAA deployments backed by MySQL using its default collation; PostgreSQL and HSQLDB backends are not affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Cloud Foundry UAA 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cloud Foundry UAA是美国Cloud Foundry基金会的一款身份认证与授权管理平台。 Cloud Foundry UAA 78.16.0之前版本和Cloud Foundry cf-deployment 57.0.0之前版本存在输入验证错误漏洞，该漏洞源于身份区域授权检查对大小写敏感性处理不当，仅持有zones.write权限的远程认证攻击者可通过在请求路径和请求体中引用非小写形式的区域标识符绕过授权限制，覆盖JWT签名密钥并伪造JWT，从而完全控制UAA及信任它的Cloud Foundr
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cloud Foundry | UAA | 0 ~ 78.16.0 | - |
|
| Cloud Foundry | cf-deployment | 0 ~ 57.0.0 | - |
|
II. Public POCs for CVE-2026-59335
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59335
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-59335 (1)
IV. Related Vulnerabilities
Same product: UAA
-
CVE-2026-59357
Self-UAA OIDC Configuration allows JWT injection to establis -
CVE-2026-59358
UAA OAuth Token Endpoint Vulnerability allows user access to -
CVE-2026-47839
Federated OIDC Users Can Bypass externalGroupsWhitelist to G -
CVE-2026-47840
LDAP StartTLS unconditionally disables hostname verification -
CVE-2026-41005
UAA accepts SAML Encrypted Assertions authentication bypass
Same vendor: Cloud Foundry
-
CVE-2026-59357
Self-UAA OIDC Configuration allows JWT injection to establis -
CVE-2026-59358
UAA OAuth Token Endpoint Vulnerability allows user access to -
CVE-2026-41012
BOSH vSphere CPI Improper Cert Validation -
CVE-2026-41005
UAA accepts SAML Encrypted Assertions authentication bypass -
CVE-2026-22734
Cloud Foundry UAA SAML 2.0 Signature Bypass
Same weakness: CWE-178
-
CVE-2026-114132
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy -
CVE-2026-85254
Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppre -
CVE-2026-80343
Apache Camel: Camel-Netty-HTTP Security Constraint Bypass vi -
CVE-2026-111448
Wheels 4.0.0-4.1.2 路径遍历漏洞 -
CVE-2026-109841
undici vulnerable to Subresource Integrity bypass via non-lo
V. Comments for CVE-2026-59335
No comments yet