CVE-2026-47839 — Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

CVE-2026-47839

Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin PUBLISHED

Description (CNA)

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.

Affected (CNA)

Vendor / product	Versions
Cloud Foundry Foundation / UAA	affected 0 through 77.30.0; unaffected 77.31.0
Cloud Foundry Foundation / cf-deployment	affected 0 through 48.9.0; unaffected 48.10.0

CWE

No CWE identifiers supplied.

References

https://www.cloudfoundry.org/blog/cve-2026-47839-federated-oidc-users-can-bypass-externalgroupswhitelist-to-gain-uaa-admin/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.