CRITICAL 9.2 NVD

CVE-2026-47839

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.

References

https://www.cloudfoundry.org/blog/cve-2026-47839-federated-oidc-users-can-bypass-externalg

Published: 2026-09-11 · Source: NVD · Feed updated: 2026-09-11

This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-09-11 via NVD.

Risk Timeline

CVE Disclosed2026-09-11 · -1 days ago

Remediation Resources

Official Advisory

www.cloudfoundry.org/blog/cve-2026-47839-federated-oidc-users-can-bypa

vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.