CVE-2026-59335: Cloud Foundry UAA Auth Bypass Vulnerability

CVE-2026-59335 Overview

CVE-2026-59335 is an authorization bypass in Cloud Foundry User Account and Authentication (UAA) service. The flaw exists in the Identity Zone Endpoint, where the authorization layer performs a case-sensitive comparison against the reserved system zone identifier uaa. When UAA runs on MySQL with the default case-insensitive collation, the persistence layer resolves zone identifiers regardless of case. A remote authenticated attacker holding only the zones.write authority can supply a mixed-case identifier such as UAA to reach the privileged system zone. The bypass leads to full compromise of UAA and any Cloud Foundry deployment that trusts it. Only deployments backed by MySQL using the default collation are affected. PostgreSQL and HSQLDB backends are not vulnerable.

Critical Impact
An attacker with zones.write authority can overwrite the system zone's JWT signing key, forge administrator tokens, and take over the entire Cloud Foundry deployment.

Affected Products

Cloud Foundry UAA deployments backed by MySQL using the default case-insensitive collation
Cloud Foundry deployments that trust JWTs issued by the affected UAA instance
Multi-tenant UAA installations exposing the Identity Zone Endpoint to holders of zones.write

Discovery Timeline

2026-08-25 - CVE-2026-59335 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-59335

Vulnerability Analysis

The vulnerability is an improper handling of case sensitivity ([CWE-178]) in the identity zone authorization check. UAA enforces that the zones.write scope must not grant access to the reserved uaa system zone, because that zone controls JWT signing keys and administrator scopes for the entire deployment. The authorization filter compares the requested zone identifier against the literal string uaa using a case-sensitive comparison. An identifier such as UAA or Uaa fails this exact-match check and is treated as a non-system zone the caller may modify.

The request then reaches the persistence layer. MySQL under its default collation (utf8mb4_0900_ai_ci or utf8_general_ci) resolves the primary key lookup case-insensitively. The mixed-case identifier resolves to the real system zone row. The write proceeds against the privileged record.

Root Cause

The root cause is a normalization mismatch between two trust boundaries. The Java authorization layer treats zone identifiers as case-sensitive strings, while the MySQL storage layer treats them as case-insensitive under its default collation. No canonicalization step normalizes the zone identifier to lowercase before the authorization decision or the database lookup. PostgreSQL and HSQLDB perform case-sensitive comparisons by default, so the two layers agree and the bypass does not apply.

Attack Vector

An attacker first obtains a client or user token carrying the zones.write authority. This authority is intended to allow tenant administrators to manage their own non-system identity zones. The attacker issues a PUT request to the Identity Zone Endpoint with a non-lowercase form of the system zone identifier in both the request path and body. The authorization filter allows the request. MySQL resolves the target to the real uaa zone. The attacker overwrites the system zone's JWT signing key with attacker-controlled key material. The attacker then forges a JWT claiming the admin client and administrator scopes, and uses it to take over UAA and any downstream service that validates tokens against the compromised signing key.

See the Cloud Foundry advisory for endpoint and payload details.

Detection Methods for CVE-2026-59335

Indicators of Compromise

Requests to /identity-zones/{id} where the {id} path segment contains uppercase characters and resolves to the system zone (for example UAA, Uaa, uAa).
Successful PUT or POST responses on the Identity Zone Endpoint issued to clients or users that only hold zones.write, not zones.uaa.admin.
Unexpected rotation of the system zone JWT signing key, or new kid values appearing in issued tokens without a corresponding operator change ticket.
Newly issued tokens claiming the admin client, uaa.admin, or zones.uaa.admin scopes for principals that did not previously hold them.

Detection Strategies

Alert on any Identity Zone Endpoint request whose zone identifier does not equal its own lowercase form.
Compare the caller's granted authorities against the target zone identifier after normalization; flag any zones.write-only caller that reaches the system zone.
Monitor UAA audit logs for IdentityZoneModifiedEvent and TokenKey change events and correlate with the authenticated principal.

Monitoring Recommendations

Forward UAA audit logs and reverse-proxy access logs to a centralized analytics platform and retain them long enough to cover the disclosure window.
Track the current JWT signing key material and alert on any change not initiated by a known operator workflow.
Baseline which principals hold zones.write and review token issuance for those principals daily.

How to Mitigate CVE-2026-59335

Immediate Actions Required

Upgrade UAA to the fixed release identified in the Cloud Foundry advisory.
Rotate the system zone JWT signing key and revoke tokens issued before the rotation.
Audit all principals granted zones.write and remove the authority from clients and users that do not require multi-tenant zone management.
Review UAA audit logs for prior requests targeting the Identity Zone Endpoint with non-lowercase zone identifiers.

Patch Information

Cloud Foundry has published a fixed UAA release that canonicalizes zone identifiers to lowercase before both the authorization decision and the database lookup. Refer to the Cloud Foundry blog post for the exact fixed versions and BOSH release mappings.

Workarounds

Migrate the UAA database to PostgreSQL or HSQLDB, which perform case-sensitive identifier comparisons and are not affected.
Change the MySQL collation for the UAA schema and zone identifier column to a case-sensitive collation such as utf8mb4_0900_as_cs or utf8mb4_bin, after validating no existing zone identifiers collide.
Enforce a reverse-proxy or WAF rule that rejects Identity Zone Endpoint requests where the zone identifier path segment or body value is not fully lowercase.

bash

# Example nginx rule rejecting non-lowercase identity zone identifiers
location ~* ^/identity-zones/([^/]+) {
    if ($1 ~ [A-Z]) {
        return 400;
    }
    proxy_pass http://uaa_upstream;
}