CVE-2026-47840
High
Description
A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselves admin scopes. This affects every deployment that authenticates users against LDAP over StartTLS. Affected versions: UAA versions prior to v78.13.0; Cf-deployment versions prior to v56.2.0.
SeverityHigh
CVSS7.5
Exploit probability—
ProductCf-deployment
PublishedJul 9, 2026
First seenJul 9, 2026
Weakness typeCWE-297CWE-297
How to fix
Update
- CloudFoundry Foundation Cf-deployment56.2.0 or later
- CloudFoundry Foundation UAA78.13.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| CloudFoundry Foundation Cf-deployment | v < 56.2.0 | 56.2.0 |
| CloudFoundry Foundation UAA | v < 78.13.0 | 78.13.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.