Cloud Foundry UAA: Privilege leftover vulnerability (CVE-2026-59358)

Cloud Foundry User Account and Authentication (UAA) contains a privilege leftover vulnerability (CVE-2026-59358) that occurs when a single OAuth client ID is configured to support both public user-facing flows (e.g., PKCE) and the client_credentials grant type. An attacker can replay their own valid user JWT as a Bearer token during a client_credentials grant request to the /oauth/token endpoint. The UAA service incorrectly treats this user token as valid client authentication, resulting in the issuance of a client-only token that inherits the configured authorities of that client. If the client holds high-privilege scopes such as clients.write, an attacker can create new OAuth clients without a client secret.

Attack Chain

1. Target identification: Identify a Cloud Foundry UAA instance where a single client_id supports both public user authentication (PKCE) and client_credentials.
2. Token acquisition: Authenticate as a standard user through the public OAuth flow to obtain a valid user access token.
3. Token replay: Submit a POST request to /oauth/token with grant_type=client_credentials, providing the previously acquired user token in the Authorization: Bearer header.
4. Authentication bypass: The UAA service incorrectly validates the user token as client authentication because the client_id matches.
5. Token minting: UAA issues a new, client-only JWT that carries the authorities assigned to the exploited client ID (e.g., clients.write).
6. Unauthorized action: Use the minted client-only JWT to access restricted endpoints, such as POST /oauth/clients, to create new OAuth clients with elevated authorities.

Impact

Successful exploitation allows an attacker to create new OAuth clients with arbitrary authorities. The scope of impact is limited to the authorities granted to the specific client ID misused in the attack. If clients.write is associated with the target client, the attacker can effectively gain administrative control over client management within the UAA instance.

Recommendation

• Upgrade Cloud Foundry UAA to version 79.7.0 or newer.
• Upgrade cf-deployment to version 60.5.0 or newer.
• Audit existing OAuth client configurations: ensure that public user-facing grants and client_credentials grants are never configured for the same client_id.
• Restrict sensitive administrative scopes like clients.write to dedicated, non-public client IDs that do not support user-facing authentication flows.