Vulnerability · Published Sep 11, 2026 · Assigned by vmware

CVE-2026-47839Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

Critical 9.2

In plain English

A critical-severity improper access control in cf-deployment from Cloud Foundry Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.3%top 75.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.

Affected products (as reported)

Vendor	Product	Versions
Cloud Foundry Foundation	UAA	0 – through 77.30.0
Cloud Foundry Foundation	cf-deployment	0 – through 48.9.0

Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.cloudfoundry.org/blog/cve-2026-47839-federated-oidc-users-can-bypass-externalgroupswhitelist-to-gain-uaa-admin/