{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-59358 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-59358 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-59358 is a high-severity authentication bypass vulnerability in Cloud Foundry UAA, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-59358 and fix it if it is affected.\n\nWhat it is: CVE-2026-59358 is a high-severity authentication bypass vulnerability in Cloud Foundry UAA, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-59358 in the wild and no public exploit code.\n\nAffected product: Cloud Foundry UAA. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-59358/ (Markdown: https://insights.sbomify.com/CVE-2026-59358/index.md)","id":"CVE-2026-59358","markdown":"https://insights.sbomify.com/CVE-2026-59358/index.md","name":"CVE-2026-59358","record":{"aliases":["GHSA-hqp7-g6vh-8mf8"],"analysis":{"component_type":"cloud_service","fix_type":"patch","impacts":["privilege_escalation","code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Cloud Foundry UAA","requires_auth":"low_privilege","summary":"Authenticated users can bypass client authentication to obtain privileged client credentials, enabling privilege escalation and arbitrary client creation in Cloud Foundry UAA.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"vmware","cpe":[],"cvss":{"score":7.6,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"description":"Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret.\n\nUAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret.\n\nExploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-10-07","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-07T02:11:18Z","kind":"github_poc","ref":"https://github.com/abraxas/CVE-2026-59358","stars":0,"title":"CVE-2026-59358 - Cloud Foundry UAA - High - Remote - Privilege leftover - user PKCE token as client_credentials Bearer"}],"tier":"poc_unverified"},"has_fix":false,"headline":"UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type","id":"CVE-2026-59358","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","id":"CVE-2026-59499"},"packages":[],"prev":{"headline":"Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions","id":"CVE-2026-59357"},"products":["UAA","cf-deployment"],"published":"2026-10-06","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-06","vendors":["Cloud Foundry"]},"summary":"Authenticated users can bypass client authentication to obtain privileged client credentials, enabling privilege escalation and arbitrary client creation in Cloud Foundry UAA.","url":"https://insights.sbomify.com/CVE-2026-59358/"}