CVE-2026-40965

Vulnerability

Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server incorrectly exposes private key components for EC keys through the public /token_keys endpoint, which is intended for public key material for JWT verification. This affects deployments using EC keys for JWT signing, but not RSA key configurations [1].

Exploitation

An unauthenticated attacker with network access to the /token_keys endpoint can exploit this vulnerability. The attacker simply needs to make a request to the /token_keys endpoint to retrieve the exposed EC private key components. This allows the attacker to forge JWT tokens that appear to be legitimately signed by the server [1].

Impact

Successful exploitation allows an attacker to forge JWT tokens, which can lead to unauthorized access to protected resources or impersonation of legitimate users. This could result in significant security breaches, including data disclosure and unauthorized actions within the Cloud Foundry environment [1].

Mitigation

Users of uaa_release should upgrade to v78.13.0 or later. For CF Deployment, upgrade to v56.1.0 or later, which includes uaa_release v78.13.0. These versions address the vulnerability by preventing the exposure of EC private keys [1].