CVE-2026-47839 Cloud Foundry Foundation CVE debrief

Who should care

Operators and administrators of systems using federated OIDC providers should assess their exposure and verify configurations to prevent unauthorized access. They should review their OIDC provider configurations and restrict uaa.admin scope to necessary users. This includes verifying that externalGroupsWhitelist is properly set and not bypassed. Additionally, they should review groupMappingMode settings for AS_SCOPES and ensure that compensating controls,

Why it matters

CVE-2026-47839 allows federated OIDC users to bypass externalGroupsWhitelist restrictions and gain uaa.admin scope, potentially leading to unauthorized access and privilege elevation. Operators and administrators should verify their OIDC provider configurations and restrict uaa.admin scope to necessary users.

• Potential unauthorized access to sensitive resources
• Elevation of privileges for federated OIDC users
• Bypassing of externalGroupsWhitelist restrictions
• Verification of OIDC provider configurations required

Technical summary

The vulnerability occurs when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry, allowing users to obtain the uaa.admin scope despite restrictions. This can lead to unauthorized access and privilege elevation. The issue specifically affects federated OIDC users who can bypass externalGroupsWhitelist restrictions. Operators and administrators should verify their OIDC provider configurations and restrict uaa.admin scope to necessary users. The CVE record and NVD entry provide details on the vulnerability.

Defensive priority

Operators should verify their OIDC provider configurations to ensure that externalGroupsWhitelist is properly set and not bypassed.

Recommended defensive actions

• Verify OIDC provider configurations for externalGroupsWhitelist
• Review groupMappingMode settings for AS_SCOPES
• Restrict uaa.admin scope to necessary users
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but further verification is needed to determine the full scope of affected systems and versions. Operators should verify their OIDC provider configurations to ensure that externalGroupsWhitelist is properly set and not bypassed. The vulnerability allows federated OIDC users to bypass externalGroupsWhitelist restrictions and gain uaa.admin scope, potentially leading to unauthorized access and privilege elevation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.