TI-2026-29656 Aliases CVE-2026-41005 GHSA-wx8w-j86h-c458

UAA accepts SAML Encrypted Assertions authentication bypass

MEDIUM 40CWE-347Published 2026-06-11 · Updated 2026-06-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (authenticity) in two SAML flows: the OAuth 2.0 SAML2 bearer grant (token endpoint) and browser SSO (ACS) when wantAssertionSigned is set to false. Assertions or responses that were unsigned but contained encrypted content could still be accepted. Encryption uses the SP's public key from published metadata, therefore, any party, not only a trusted IdP, can produce ciphertext UAA can decrypt; successful decryption therefore does not prove the IdP issued the message. Affected versions: Cloud Foundry UAA (uaa_release) 2.0.0 through 78.13.0. Cloud Foundry CF Deployment all versions through 56.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00131 2nd percentileScored 2026-11-07

Fix Fixed UAA (Cloud Foundry): 78.14.0CF Deployment (Cloud Foundry): 57.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cloud Foundry	UAA	2.0.0 to before 78.14.0	78.14.0	Patch available	CNA
Cloud Foundry	CF Deployment	0.0.0 to before 57.0.0	57.0.0	Patch available	CNA

UAA VendorCloud Foundry Affected 2.0.0 to before 78.14.0 Fixed in 78.14.0 Patch available CNA
CF Deployment VendorCloud Foundry Affected 0.0.0 to before 57.0.0 Fixed in 57.0.0 Patch available CNA

Remediation

Fix · CNA UAA (Cloud Foundry) Fixed in 78.14.0
Fix · CNA CF Deployment (Cloud Foundry) Fixed in 57.0.0

Timeline

2026-10-02 Threatist record created from CVE-2026-41005
2026-10-03 Alias added: GHSA-wx8w-j86h-c458

References

Other 1

https://www.cloudfoundry.org/blog/cve-2026-41005-uaa-accepts-saml-encrypted-assertions-authentication-bypass/

TI-2018-11240 UAA Privilege Escalation CVSS 3.0CRITICAL 9.9
TI-2018-01169 Log Cache logs UAA client secret on startup CVSS 3.0CRITICAL 9.8
TI-2018-07868 Cloud Foundry UAA MFA does not prevent brute force of MFA code CVSS 3.0CRITICAL 9.8
TI-2026-18259 Cloud Foundry UAA SAML 2.0 Signature Bypass CVSS 3.1HIGH 8.6
TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
TI-2024-24613 Authentication bypass by spoofing in Cloud Foundry haproxy-boshrelease CVSS 3.1CRITICAL 9.1

See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences