Critical severity · published Sep 11, 2026
CVE-2026-47839
Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin
9.2
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UA
UAA · Cloud Foundry Foundation
through 77.30.0 · source: vendor
CF
cf-deployment · Cloud Foundry Foundation
through 48.9.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47839
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47839
www.cloudfoundry.org
https://www.cloudfoundry.org/blog/cve-2026-47839-federated-oidc-users-can-bypass-externalgroupswhitelist-to-gain-uaa-admin/
More from cf-deployment
10.0
CVE-2026-40965
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure
7.5
CVE-2026-40964
Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for…