CVE-2026-47840: LDAP StartTLS unconditionally disables hostname verification
A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselves admin scopes. This affects every deployment that authenticates users against LDAP over StartTLS. Affected versions: UAA versions prior to v78.13.0; Cf-deployment versions prior to v56.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UAAto a version that resolves this vulnerability.Fixed in 78.13.0 - Upgrade
Upgrade
Cloud Foundry deployment (cf-deployment)to a version that resolves this vulnerability.Fixed in 56.2.0 - Configuration
For LDAP authentication over StartTLS, ensure hostname verification is not unconditionally disabled; configure StartTLS to verify the LDAP server hostname against the certificate.
LDAP StartTLS (hostname verification) hostname verification = enable
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47840?
The severity of CVE-2026-47840 is high, rated at 7.5.
How does CVE-2026-47840 affect Cloud Foundry UAA?
CVE-2026-47840 affects Cloud Foundry UAA by allowing network attackers to impersonate the LDAP directory, compromising user authentication.
What are the potential consequences of CVE-2026-47840?
The potential consequences of CVE-2026-47840 include the harvesting of LDAP bind passwords and end-user passwords during authentication.
How do I fix CVE-2026-47840?
To fix CVE-2026-47840, it is recommended to implement hostname verification in the LDAP StartTLS configuration.
Who is affected by CVE-2026-47840?
Organizations using Cloud Foundry UAA and its deployments are potentially affected by CVE-2026-47840.