CVE-2026-59335
Received Received - Intake

Case-Sensitive Authorization Bypass in Cloud Foundry UAA

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VMware

Description
Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to the privileged uaa (system) identity zone, by referring to the zone identifier in a non-lowercase form (e.g. UAA) in the request path and body. The authorization layer performs a case-sensitive comparison against the system zone identifier, while the underlying MySQL persistence layer resolves identifiers case-insensitively under its default collation, so the request is authorized incorrectly and is then resolved against the real system zone record. This allows the attacker to overwrite the system zone's JWT signing key with attacker-controlled key material, forge JWTs claiming the admin client and administrator scopes, and fully compromise UAA and any Cloud Foundry deployment that trusts it. This issue only affects UAA deployments backed by MySQL using its default collation; PostgreSQL and HSQLDB backends are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-59335
EUVD
EUVD-2026-65466

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vmware cloud_foundry_uaa 78.16.0
vmware cloud_foundry 57.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59335 is an authorization bypass flaw in Cloud Foundry's UAA service due to improper case sensitivity handling. An authenticated attacker with zones.write authority can bypass restrictions by using non-lowercase zone identifiers (e.g., UAA) in requests. This exploits a mismatch between case-sensitive authorization checks and case-insensitive MySQL collation, allowing unauthorized access to the system identity zone. The attacker can then overwrite the system zone's JWT signing key, forge admin tokens, and fully compromise UAA and dependent Cloud Foundry deployments.

Detection Guidance

To detect this vulnerability, check if your UAA deployment uses MySQL with the default collation. Review logs for case-insensitive zone identifier usage in requests. Verify if zone identifiers in requests or responses deviate from lowercase standards.

Impact Analysis

If you use Cloud Foundry with UAA backed by MySQL, an attacker could gain full control over your UAA deployment and all resources it protects. This includes forging tokens with admin privileges, accessing sensitive data, and altering system configurations. The impact is limited to MySQL-backed UAA deployments; PostgreSQL and HSQLDB are unaffected.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. A full system compromise may result in data breaches, unauthorized disclosure of personal health information, or other compliance violations. Organizations must address this flaw to maintain regulatory compliance.

Mitigation Strategies

Upgrade UAA to version 78.16.0 or later and CF Deployment to version 57.0.0 or later. If using MySQL, ensure case-sensitive handling of zone identifiers in UAA configurations. Monitor for unauthorized JWT signing key modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59335. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart