CVE-2026-47840: Cloud Foundry UAA Flaw Exposes LDAP StartTLS to MITM Attacks

A newly disclosed vulnerability in Cloud Foundry’s User Account and Authentication (UAA) service exposes organizations using LDAP with StartTLS to a serious man-in-the-middle attack, one that lets a network-positioned adversary harvest credentials and grant themselves administrator privileges without ever cracking a password.

Tracked as CVE-2026-47840, the flaw was disclosed on July 8, 2026, by the Cloud Foundry Foundation Security Team. It carries a CVSS 4.0 score of 8.3 (High) and a CVSS 3.1 score of 7.5 (High), reflecting how easily it can be exploited and how much damage it can cause once triggered.

Cloud Foundry UAA Flaw

The vulnerability lives in how UAA handles StartTLS when connecting to an LDAP directory. StartTLS is designed to upgrade a plaintext LDAP connection (typically over port 389) to an encrypted one, verifying the server’s identity along the way using its TLS certificate.

According to the advisory, UAA unconditionally disables hostname verification during this upgrade. That means UAA will accept any certificate issued by a trusted Certificate Authority, regardless of whether it matches the LDAP server’s hostname.

In practice, this collapses the entire trust model StartTLS depends on. An attacker who can position themselves on the network path between UAA and the LDAP directory, through DNS spoofing, ARP poisoning, a compromised router, or similar techniques, can impersonate the real LDAP server using a certificate that has zero connection to that server’s actual identity.

Once the attacker impersonates the LDAP directory, the impact cascades quickly:

They intercept the LDAP bind password UAA uses to authenticate to the directory.
They capture every end-user password submitted during simple-bind authentication, since credentials are relayed through the attacker’s fake server.
They can forge group membership responses, telling UAA that a chosen account belongs to admin-scoped groups, effectively granting themselves elevated privileges inside the platform.

This turns a network positioning attack into full credential theft and privilege escalation without needing to break encryption or guess passwords. The CVSS 4.0 vector confirms this severity, flagging high impact to both confidentiality (VC:H) and integrity (VI:H), with no user interaction required (UI:N) and low attack complexity (AC:L).

The vulnerability affects two Cloud Foundry components:

UAA: all versions prior to v78.13.0
cf-deployment: all versions prior to v56.2.0

You’re vulnerable if you meet both conditions: running an unpatched UAA version, and configured to use LDAP with StartTLS (usually visible as an ldap:// profile URL on port 389 with TLS upgrade enabled).

You’re in the clear if any of the following apply: you’ve already upgraded to UAA v78.13.0 or later, you exclusively use LDAPS (ldaps://, typically port 636) instead of StartTLS, or you don’t use LDAP for authentication at all, relying instead on SAML, OIDC, or UAA’s internal user store.

Remediation

Cloud Foundry’s security team is urging immediate upgrades rather than workarounds, given how central authentication trust is to this flaw:

Upgrade UAA to version v78.13.0 or later.
Upgrade cf-deployment to version v56.1.0 or later.
Where upgrading isn’t immediately possible, switching LDAP configurations from StartTLS to native LDAPS removes the vulnerable code path entirely, since hostname verification is handled differently.

No credit was listed for the discovery, and the advisory doesn’t indicate active exploitation in the wild as of publication. Given the low attack complexity and the platform’s widespread use in enterprise environments for identity brokering, security teams running Cloud Foundry deployments with LDAP integration should treat this as a priority patch rather than a routine update.