CVE-2026-59335

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA (affected versions not specified)

Description Improper handling of case sensitivity in the identity zone authorization check within the Identity Zone Endpoint allows a remote authenticated attacker with zones.write authority to bypass restrictions protecting the privileged uaa (system) identity zone. By using a non-lowercase zone identifier (e.g., UAA) in the request path and body, the attacker can exploit a discrepancy where the authorization layer performs a case-sensitive comparison, but the MySQL persistence layer resolves identifiers case-insensitively under its default collation. This allows the attacker to overwrite the system zone's JWT signing key with controlled material and forge JSON Web Tokens (JWTs) claiming admin client and administrator scopes, leading to a full compromise of UAA and trusting Cloud Foundry deployments. This issue specifically affects deployments using MySQL with default collation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.