cloudfoundry uaa-release vulnerabilities

Latest cloudfoundry uaa-release CVEs

Newest publication first

1. CVE-2026-22723 UAA User Token Revocation logic error

   Published 2026-03-05

   Medium·CVSS 6.5 EPSS 0.26%

   Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.

2. CVE-2017-8031 Cloud Foundry UAA Denial of Service through client token revocation endpoint

   Published 2017-11-27

   Medium·CVSS 5.3 EPSS 1.1%

   An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke clien...

3. CVE-2016-0732 The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0...

   Published 2017-09-07

   High·CVSS 8.8 EPSS 1.2%

   The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.