CVE-2026-40965: Infoleak
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed through the public /tokenkeys endpoint. This endpoint is designed to provide public key material for JWT token verification but incorrectly exposes private key components for EC keys. The vulnerability affects deployments using EC keys for JWT token signing. The vulnerability does not affect RSA key configurations, only deployments using EC keys for JWT signing.
Affected versions: - uaarelease: v76.12.0 through v78.12.0 (inclusive); fixed in v78.13.0 or later - CF Deployment: v30.0.0 through v56.0.0 (inclusive); fixed in v56.1.0 or later (bundles uaarelease v78.13.0)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CF Deployment (Cloud Foundry)to a version that resolves this vulnerability.Fixed in 56.1.0 - Upgrade
Upgrade
uaa_releaseto a version that resolves this vulnerability.Fixed in 78.13.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40965?
CVE-2026-40965 has a critical severity rating of 10.
How do I fix CVE-2026-40965?
To fix CVE-2026-40965, upgrade Cloud Foundry UAA to the latest version beyond v78.12.0.
What vulnerabilities are associated with CVE-2026-40965?
CVE-2026-40965 is associated with the exposure of EC private keys through the public /token_keys endpoint in Cloud Foundry UAA.
What versions of Cloud Foundry UAA are affected by CVE-2026-40965?
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are affected by CVE-2026-40965.
What type of attack is possible due to CVE-2026-40965?
CVE-2026-40965 allows for information leakage, potentially exposing sensitive private key material.