Information disclosure in Cloud Foundry Foundation Cf Deployment

CVE-2026-40965

Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed through the public /token_keys endpoint. This endpoint is designed to provide public key material for JWT token verification but incorrectly exposes private key components for EC keys. The vulnerability affects deployments using EC keys for JWT token signing. The vulnerability does not affect RSA key configurations, only deployments using EC keys for JWT signing. Affected versions: - uaa_release: v76.12.0 through v78.12.0 (inclusive); fixed in v78.13.0 or later - CF Deployment: v30.0.0 through v56.0.0 (inclusive); fixed in v56.1.0 or later (bundles uaa_release v78.13.0)

Vulnerability class: Information Disclosure

Published · last modified .

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.

EPSS exploit prediction

EPSS: 0.005 (38.2th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 38.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-40965: held from 0.003 to 0.005.

EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.001

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-40965?
CVE-2026-40965 is a critical-severity vulnerability in Cloud Foundry Foundation Cf Deployment, classified under Information Disclosure. CVSS score: 10.0/10. Published 2026-06-01.
How severe is CVE-2026-40965?
Critical severity. CVSS v3 base score is 10.0 out of 10.