Loading story…
Cloud Foundry disclosed CVE-2026-40965, a high-severity vulnerability in UAA that can expose Elliptic Curve private key material through the public /token_keys JSON endpoint. The endpoint is meant to publish public keys for JWT verification, but affected deployments using EC keys for token signing could inadvertently return private key components, creating a risk of token forgery and broader compromise of authentication trust. The issue is tracked under CWE-200 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.
The flaw affects Cloud Foundry UAA versions v76.12.0 through v78.12.0 and CF Deployment versions v30.0.0 through v56.0.0. Cloud Foundry said the issue does not affect RSA-based configurations, and fixes are available in uaa_release v78.13.0 and CF Deployment v56.1.0 or later. A separate Cloud Foundry advisory also disclosed CVE-2026-40964, involving unauthorized read access to CF logs, indicating multiple security issues were addressed in the platform during the same disclosure period.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Cloud Foundry maintainers advised users affected by CVE-2026-40965 to upgrade UAA to v78.13.0 or later and deployments using global configuration templates to v56.1.0 or later. The guidance accompanied reporting that the flaw exposed EC private keys via the public /token_keys endpoint.
Cloud Foundry published an advisory for CVE-2026-40964 concerning unauthorized read access to Cloud Foundry logs. The reference identifies this as a separate vulnerability disclosure event.
Cloud Foundry published an advisory for CVE-2026-40965 describing that the public /token_keys endpoint could expose EC private key material in UAA deployments using Elliptic Curve keys for JWT signing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourcecloudfoundry.org
Open sourcecloudfoundry.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw tracked as **`CVE-2026-59099`** was disclosed in **Apereo CAS**, the open-source single sign-on platform, affecting versions **7.3.0 through 8.0.0-RC5**. The bug stems from **AES-GCM nonce reuse** caused by a fixed all-zero IV being used with the same encryption key for the life of the server, allowing an unauthenticated remote attacker to collect client-side webflow execution tokens from the login page and use known-plaintext techniques to decrypt webflow conversation state. The issue can expose sensitive session, identity, and application data, and was rated **critical** with **CVSS 4.0 9.3** and **CVSS 3.1 9.1**. The disclosure highlights how cryptographic implementation mistakes can turn protected traffic or tokens into recoverable plaintext, echoing earlier SSL/TLS weaknesses such as attacks against **RC4** that similarly enabled partial plaintext recovery from encrypted sessions. Apereo was notified on June 16, fixed the issue on June 17, and released patched versions on June 18; affected organizations were urged to upgrade to **`8.0.0-RC6`** or the relevant patch release and to rotate signing and encryption keys if they had operated vulnerable deployments.
Jul 12, 2026
Researcher Sammy Azdoufal publicly disclosed a broad set of vulnerabilities in Aqara’s cloud platform, including **CVE-2026-50084**, a critical authorization flaw in the production API that allowed any valid developer token to access user-scoped endpoints for arbitrary accounts. The issue, rated **CVSS 9.6** and classified as `CWE-862`, affected `open-cn.aqara.com/v3.0/open/api` and stemmed from missing per-account authorization checks rather than the platform’s MD5-based request-signing scheme. Aqara said the flaw was fixed in April, before public disclosure, but the researcher reported mixed remediation status across the wider set of findings. The disclosure tied **ten CVEs** to Aqara cloud, mobile, and developer systems, including hardcoded OAuth credentials in the IAM/SSO gateway (**CVE-2026-50083**), an unauthenticated MQTT debug interface in Aqara Board (**CVE-2026-50085**), an unauthenticated AES oracle (**CVE-2026-50086**), permissive CORS issues (**CVE-2026-50087**, **CVE-2026-50088**), an OAuth `redirect_uri` validation bypass (**CVE-2026-50090**), and hardcoded cryptographic keys in the Aqara Home Android SDK (**CVE-2026-50091**). According to the advisory and CVE records, several of these flaws could be chained with **CVE-2026-50084** to achieve **fully unauthenticated remote takeover of affected devices**, while the GitHub disclosure also alleged additional exposures in Aqara back-office infrastructure and disputed the vendor’s claim that the impact was limited to test environments.
Jun 29, 2026
Keycloak disclosed and patched a high-severity privilege escalation flaw, **CVE-2026-9795**, in its Fine-Grained Admin Permissions v2 (`FGAPv2`) feature after researchers reported that a delegated administrator could bypass missing authorization checks in the admin REST API and add arbitrary realm roles to a client’s scope mapping. That weakness allowed limited administrators to inject elevated roles such as `realm-admin` into tokens later issued to users authenticating through the affected client, creating a path to downstream privilege escalation in deployments running Keycloak `26.2.0` and later with `FGAPv2` enabled. The issue was later listed as fixed in Keycloak release `26.6.4`, alongside several other security bugs including **CVE-2026-9099**, **CVE-2026-9083**, **CVE-2026-9086**, **CVE-2026-9705**, **CVE-2026-9799**, **CVE-2026-9800**, and **CVE-2026-11800**. Red Hat also shipped security updates for its Keycloak `26.4.11` images and operator on OpenShift, addressing a broad set of vulnerabilities across the Admin REST API, Account REST API, OIDC dynamic client registration, UMA authorization, token handling, redirect validation, and scope processing, with impacts ranging from information disclosure and SSRF to account takeover, policy bypass, and denial of service.
Jul 12, 2026