CVE-2026-47839

Friday, September 11, 2026

9.2

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.

Affected Software

Vendor	Product	Version Range	Status
Cloud Foundry Foundation	UAA	`0 <= 77.30.0`	affected
Cloud Foundry Foundation	UAA	`77.31.0`	unaffected
Cloud Foundry Foundation	cf-deployment	`0 <= 48.9.0`	affected
Cloud Foundry Foundation	cf-deployment	`48.10.0`	unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: total

References

https://www.cloudfoundry.org/blog/cve-2026-47839-federated-oidc-users-can-bypass-externalgroupswhitelist-to-gain-uaa-admin/

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.