CVE-2026-40965

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions v76.12.0 through v78.12.0 CF Deployment versions v30.0.0 through v56.0.0

Description Private key exposure occurs when the server inadvertently reveals Elliptic Curve (EC) private keys through the public '/token keys' endpoint. While this endpoint is intended to provide public key material for JSON Web Token (JWT) verification, it incorrectly exposes private key components for EC keys. This issue specifically affects deployments using EC keys for JWT token signing and does not impact RSA key configurations.

Recommendations Update uaa release to version v78.13.0 or later. Update CF Deployment to version v56.1.0 or later. Rotate EC keys used for JWT token signing. As a temporary mitigation, disable the use of EC keys for JWT signing.