CVE-2026-47840— LDAP StartTLS unconditionally disables hostname verification
Possible ATT&CK Techniques 1AI
T1557 · Adversary-in-the-MiddleAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| CloudFoundry Foundation | Cf-deployment | < 56.2.0 | affected |
| CloudFoundry Foundation | UAA | < 78.13.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47840
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LDAP StartTLS unconditionally disables hostname verification
Source: CVE Program / CVE List V5
Vulnerability Description
A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselves admin scopes. This affects every deployment that authenticates users against LDAP over StartTLS. Affected versions: UAA versions prior to v78.13.0; Cf-deployment versions prior to v56.2.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
CloudFoundry Foundation UAA 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CloudFoundry Foundation UAA是CloudFoundry Foundation基金会的一个身份认证和用户账户管理平台。 CloudFoundry Foundation UAA 78.13.0之前版本存在加密问题漏洞，该漏洞源于UAA与LDAP目录之间的证书身份验证问题，可能导致网络攻击者冒充目录，获取LDAP绑定密码和用户密码，并返回伪造的组成员身份以授予管理员权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| CloudFoundry Foundation | UAA | 0 ~ 78.13.0 | - | |
| CloudFoundry Foundation | Cf-deployment | 0 ~ 56.2.0 | - |
II. Public POCs for CVE-2026-47840
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47840
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-47840 (1)
Same Patch Batch · CloudFoundry Foundation · 2026-07-09 · 3 CVEs total
| CVE-2026-47829 | Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via | |
| CVE-2026-47826 | blobs.yaml Path Traversal Allows File Writes |
IV. Related Vulnerabilities
Same product: UAA
- CVE-2026-41005
UAA accepts SAML Encrypted Assertions authentication bypass - CVE-2026-22723
UAA User Token Revocation logic error - CVE-2025-22246
CVE-2025-22246 – UAA Private Key Exposure - CVE-2024-38806
UAA Failure to Remove Shadow User’s Access - CVE-2020-5402
UAA fails to check the state parameter when authenticating w
Same vendor: CloudFoundry Foundation
- CVE-2026-47829
Argument Injection in BOSH CLI Allows Local Command Executio - CVE-2026-47826
blobs.yaml Path Traversal Allows File Writes - CVE-2026-41013
Tenant-controlled comma smuggles arbitrary CIFS mount option - CVE-2026-22726
Route Services Firewall Bypass - CVE-2026-22723
UAA User Token Revocation logic error
V. Comments for CVE-2026-47840
No comments yet