Cloud Foundry Cf-Deployment vulnerabilities

CVE-2026-59358 [HIGH] CWE-287 CVE-2026-59358: Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in pl

CVE-2026-59335 [HIGH] CWE-178 CVE-2026-59335: Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Iden Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to the privileged uaa (system) identity zone, by referring

CVE-2019-3801 [CRITICAL] CWE-494 CVE-2019-3801: Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an inse Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.

CVE-2026-59357 [MEDIUM] CWE-345 CVE-2026-59357: Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Clou Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting a UAA access token or a cross-client ID token as