CVE-2026-47839

CriticalCVSS 9.2/10Last modified Sep 18, 2026

Description

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.

Metrics

CVSS 4.0 9.2/10

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Cloud Foundry Foundation	UAA	<= 77.30.0
Cloud Foundry Foundation	cf-deployment	<= 48.9.0

References

https://www.cloudfoundry.org/blog/cve-2026-47839-federated-oidc-users-can-bypass-externalgroupswhitelist-to-gain-uaa-admin/

Timeline

Published: Sep 11, 2026
Last modified: Sep 18, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-47849.8A vulnerability was found in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /checkcheckout.php of the CVE-2026-478407.5A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, th CVE-2026-478417.4An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session CVE-2026-478426.5Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode en CVE-2026-478433.7In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previousl CVE-2026-478443.7In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the CVE-2026-478455.3In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order f CVE-2026-478469.8Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is config CVE-2026-478475.3Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replicatio CVE-2026-478486.1In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials CVE-2026-478497.1Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/jso CVE-2026-47856.4The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th