CVE-2026-41005 Details
Description
Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (authenticity) in two SAML flows: the OAuth 2.0 SAML2 bearer grant (token endpoint) and browser SSO (ACS) when wantAssertionSigned is set to false. Assertions or responses that were unsigned but contained encrypted content could still be accepted. Encryption uses the SP's public key from published metadata, therefore, any party, not only a trusted IdP, can produce ciphertext UAA can decrypt; successful decryption therefore does not prove the IdP issued the message. Affected versions: Cloud Foundry UAA (uaa_release) 2.0.0 through 78.13.0. Cloud Foundry CF Deployment all versions through 56.1.0.
A vulnerability exists in Cloud Foundry UAA versions 2.0.0 prior to 78.13.0, and in Cloud Foundry CF Deployment all versions prior to 56.1.0. This vulnerability arises because UAA incorrectly equated XML encryption received from the Service Provider, which ensures confidentiality, with the authenticity provided by XML signatures from the Identity Provider. This misinterpretation occurred in two SAML flows: the OAuth 2.0 SAML2 bearer grant at the token endpoint, and browser SSO at the ACS, when 'wantAssertionSigned' was set to false. As a result, unsigned assertions or responses that included encrypted content could still be accepted. The encryption utilized the Service Provider's public key from published metadata, allowing any party, not just a trusted Identity Provider, to create ciphertext that UAA could decrypt. Consequently, successful decryption did not verify that the Identity Provider had issued the message.
Users are advised to upgrade to Cloud Foundry UAA versions 78.15.0 or greater, and to upgrade Cloud Foundry CF Deployment to version 57.0.0 or greater, which includes UAA version 78.16.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cloudfoundry.org/blog/cve-2026-41005-uaa-accepts-saml-encrypted-assertions-authentication-bypass/ | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |