CVE-2026-47839

Cloud Foundry's UAA (User Account and Authentication) identity server — assigned by VMware's security team ([email protected]) — allows users who authenticate through a federated OIDC identity provider to be granted the powerful uaa.admin scope even when operators have restricted what that provider can confer. The flaw is triggered specifically when the OIDC identity provider is configured with groupMappingMode: AS_SCOPES and its externalGroupsWhitelist contains a wildcard entry, in which case the whitelist restriction is bypassed. An attacker with an account at such a federated provider can obtain uaa.admin privileges on the UAA server, effectively gaining administrative control over users, clients, and scopes on the platform. Affected organizations are Cloud Foundry/Tanzu operators who federate login to an OIDC provider under that exact configuration; patched version ranges were not provided in the available data. No public proof of concept is known and the flaw is not in CISA KEV, so exploitation is not currently observed (CVSS 4.0: 9.2, critical).

What to do: Audit UAA identity-provider configurations for OIDC providers using groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry, and review federated accounts and issued tokens for unexpected uaa.admin grants. Upgrade UAA to the patched release cited in the VMware/Cloud Foundry security advisory (version not specified in the available data); as an interim mitigation, remove the wildcard whitelist entry or tighten group-to-scope mappings for the provider. Since there is no known exploitation and no public PoC, patching can follow normal critical-severity cycles, prioritizing foundations where federated identity providers are reachable by third parties.