{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/cloud-foundry-foundation/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-59358"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["UAA (\u003c v79.7.0)","cf-deployment (\u003c v60.5.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","cloud-foundry","oauth","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Cloud Foundry Foundation","Broadcom"],"content_html":"\u003cp\u003eCloud Foundry User Account and Authentication (UAA) contains a privilege leftover vulnerability (CVE-2026-59358) that occurs when a single OAuth client ID is configured to support both public user-facing flows (e.g., PKCE) and the \u003ccode\u003eclient_credentials\u003c/code\u003e grant type. An attacker can replay their own valid user JWT as a Bearer token during a \u003ccode\u003eclient_credentials\u003c/code\u003e grant request to the \u003ccode\u003e/oauth/token\u003c/code\u003e endpoint. The UAA service incorrectly treats this user token as valid client authentication, resulting in the issuance of a client-only token that inherits the configured authorities of that client. If the client holds high-privilege scopes such as \u003ccode\u003eclients.write\u003c/code\u003e, an attacker can create new OAuth clients without a client secret.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eTarget identification: Identify a Cloud Foundry UAA instance where a single \u003ccode\u003eclient_id\u003c/code\u003e supports both public user authentication (PKCE) and \u003ccode\u003eclient_credentials\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eToken acquisition: Authenticate as a standard user through the public OAuth flow to obtain a valid user access token.\u003c/li\u003e\n\u003cli\u003eToken replay: Submit a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003e/oauth/token\u003c/code\u003e with \u003ccode\u003egrant_type=client_credentials\u003c/code\u003e, providing the previously acquired user token in the \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eAuthentication bypass: The UAA service incorrectly validates the user token as client authentication because the \u003ccode\u003eclient_id\u003c/code\u003e matches.\u003c/li\u003e\n\u003cli\u003eToken minting: UAA issues a new, client-only JWT that carries the authorities assigned to the exploited client ID (e.g., \u003ccode\u003eclients.write\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eUnauthorized action: Use the minted client-only JWT to access restricted endpoints, such as \u003ccode\u003ePOST /oauth/clients\u003c/code\u003e, to create new OAuth clients with elevated authorities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to create new OAuth clients with arbitrary authorities. The scope of impact is limited to the authorities granted to the specific client ID misused in the attack. If \u003ccode\u003eclients.write\u003c/code\u003e is associated with the target client, the attacker can effectively gain administrative control over client management within the UAA instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Cloud Foundry UAA to version 79.7.0 or newer.\u003c/li\u003e\n\u003cli\u003eUpgrade cf-deployment to version 60.5.0 or newer.\u003c/li\u003e\n\u003cli\u003eAudit existing OAuth client configurations: ensure that public user-facing grants and \u003ccode\u003eclient_credentials\u003c/code\u003e grants are never configured for the same \u003ccode\u003eclient_id\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRestrict sensitive administrative scopes like \u003ccode\u003eclients.write\u003c/code\u003e to dedicated, non-public client IDs that do not support user-facing authentication flows.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T09:00:12Z","date_published":"2026-10-29T09:00:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-59358/","summary":"A privilege leftover vulnerability in Cloud Foundry UAA allows authenticated users to reuse their access tokens to impersonate a client and gain unauthorized authorities, such as the ability to create new OAuth clients.","title":"Cloud Foundry UAA: Privilege leftover vulnerability (CVE-2026-59358)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-59358/"}],"language":"en","title":"CraftedSignal Threat Feed - Cloud Foundry Foundation","version":"https://jsonfeed.org/version/1.1"}