CVE-2026-22734 - Vulnerability Analysis

Overview

Cloud Foundry UAA 77.30.0 to 78.7.0 and CF Deployment 48.7.0 to 54.14.0 contain an authentication bypass caused by acceptance of unsigned and unencrypted SAML 2.0 bearer assertions, letting attackers obtain tokens for any user, exploit requires SAML 2.0 bearer assertions enabled.

Severity & Score

Impact

Attackers can obtain tokens for any user, gaining unauthorized access to protected systems.

Mitigation

Update to versions later than 78.7.0 for UAA and 54.14.0 for CF Deployment or latest available versions.

References

• https://www.cloudfoundry.org/blog/cve-2026-22734-uaa-saml-2-0-signature-bypass/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner