CVE-2026-40965

The /token_keys endpoint is designed solely to provide public key material for JWT token verification. However, an implementation error causes the server to return not only the public part but also private key components for EC type keys. Any user with network access to the UAA instance can send an HTTP request to this endpoint without any authentication and receive the private key. The vulnerability affects only configurations using EC keys for JWT signing — configurations based on RSA keys are not exposed.

An attacker who obtains the EC private key can independently generate and sign arbitrary JWT tokens, impersonating any user or gaining unauthorized access to resources protected by Cloud Foundry. As a result, complete takeover of the environment is possible as well as compromise of dependent systems (so-called subscriber systems).

Update uaa_release to version v78.13.0 or later. If using CF Deployment, update to version v56.1.0 or later (contains uaa_release v78.13.0). After updating, it is recommended to rotate all EC keys used for JWT signing, as private keys may have been previously disclosed, and invalidate JWT tokens issued before the fix.

Cloud Foundry UAA in versions v76.12.0 through v78.12.0 (inclusive) and CF Deployment in versions v30.0.0 through v56.0.0 (inclusive) — only deployments using EC (Elliptic Curve) keys for JWT signing. Deployments based on RSA keys are not vulnerable.