Case Sensitivity Flaw in Identity Zone Authorization Check for Cloud Foundry UAA

CVE-2026-59335

What is CVE-2026-59335?

A vulnerability exists in the Identity Zone Endpoint of Cloud Foundry UAA, where improper handling of case sensitivity allows remote authenticated attackers to bypass authorization constraints. By presenting the zone identifier in a non-lowercase format, attackers can exploit the case-sensitive nature of the authorization checks against the system zone identifier. This leads to improper authorization and allows attackers with the zones.write authority to overwrite the system zone's JWT signing key. As a result, they can forge JWTs with elevated privileges, jeopardizing the integrity of the UAA and any Cloud Foundry deployments that rely on it. This issue specifically affects UAA deployments using MySQL with default collation settings; deployments with PostgreSQL or HSQLDB are not at risk.

References