External risk intelligence

Cloud Foundry UAA EC Private Key Exposure

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-40965

The vulnerability exists in the Cloud Foundry UAA (User Account and Authentication) service, which is a central identity provider. The affected /token_keys endpoint is a public-facing component by design, intended to be accessible to any client or service that needs to verify JWT tokens in typical deployment patterns.

Information Disclosure

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Cloud Foundry's User Account and Authentication service, affecting certain versions that use Elliptic Curve keys. This issue could allow for the inadvertent exposure of private keys through a public endpoint designed for token verification, which could have significant implications for security if not addressed.

Private keys may be exposed publicly.
Potential for broad security impact.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by accessing the public `/token_keys` endpoint on a vulnerable Cloud Foundry UAA service. This endpoint, intended to provide public keys for verifying tokens, inadvertently exposes EC private key components when the service uses EC keys for signing JWTs. This exposure could allow an attacker to compromise the security of JWT verification and potentially gain unauthorized access.

Attacker accesses public `/token_keys` endpoint.
Server exposes EC private key components.
Compromised JWT verification.

Live Threat

Current exploitation, exposure, and threat context

The Cloud Foundry UAA can inadvertently expose EC private keys through its public `/token_keys` endpoint when configured to use EC keys for signing JWT tokens. This could allow an attacker to impersonate users or services, or forge tokens, when supported by the advisory.

Server EC private keys.
Via public /token_keys endpoint.
Token forgery and impersonation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Cloud Foundry UAA's private key exposure requires coordination between platform and security teams. The first step is to identify all UAA instances using EC keys for JWT signing, determine their exposure and business criticality, and then engage the accountable platform or security owner to plan remediation.

Platform and Security teams own the fix.
Verify EC key usage and /token\_keys endpoint reachability.
Plan urgent vendor coordination and upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cloud Foundry UAA?

Cloud Foundry UAA (User Account and Authentication) is a multi-tenant identity management service. It acts as the central hub for issuing and validating identity tokens, such as JSON Web Tokens (JWTs), which allow different parts of a software system to securely verify user identities and permissions.

What does CWE-200 mean for CVE-2026-40965?

CWE-200 refers to an Information Exposure weakness. In this specific case, the UAA service fails to keep secret information private. While the software is designed to share public keys for token validation, a logic error causes it to include sensitive Elliptic Curve (EC) private keys in that same public response, effectively leaking the cryptographic secrets used to sign tokens.

How is this vulnerability triggered?

The issue is triggered by accessing the public /token_keys endpoint on an affected UAA instance that is configured to use Elliptic Curve keys for signing JWTs. If your deployment uses RSA keys instead of EC keys for token signing, this specific bug does not trigger because the exposure logic is tied exclusively to the EC key handling process.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because the /token_keys endpoint is intentionally public to support standard identity verification flows, any instance using vulnerable versions and EC keys is highly accessible to unauthorized callers. If your UAA service is reachable over the network, it is very likely exposed to this risk.

How do I start addressing this CVE?

Begin by auditing your current UAA deployments to see if they use Elliptic Curve (EC) keys for JWT signing and if they fall within the affected version ranges. Once identified, prioritize these instances for an upgrade to the fixed version provided by the vendor, ensuring your platform team coordinates the patch to secure your identity infrastructure.

References

www.cloudfoundry.org/blog/cve-2026-40965-uaa-ec-private-key-disclosure/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.