CVE-2026-40965Patch

LOWCVSS 10.0 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed through the public /token_keys endpoint. This endpoint is designed to provide public key material for JWT token verification but incorrectly exposes private key components for EC keys. The vulnerability affects deployments using EC keys for JWT token signing. The vulnerability does not affect RSA key configurations, only deployments using EC keys for JWT signing. Affected versions: - uaa_release: v76.12.0 through v78.12.0 (inclusive); fixed in v78.13.0 or later - CF Deployment: v30.0.0 through v56.0.0 (inclusive); fixed in v56.1.0 or later (bundles uaa_release v78.13.0)

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://www.cloudfoundry.org/blog/cve-2026-40965-uaa-ec-private-key-disclosure/

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
10 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 8 signals
Technical details provided in 10 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-06-08); latest day: 2
10 total mentions across 5 days

Deep dive

Activity timeline10 mentions / 5d

Signal classification2 categories

Patch

660.0%

Disclosure

440.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-01	2	Disclosure2
2026-06-02	2	Patch2
2026-06-07	1	Patch1
2026-06-08	3	Patch3
2026-06-12	2	Disclosure2

Full discourse10 posts

yousukezan@yousukezan130d
Patch
Cloud Foundryの認証基盤で、認証不要で秘密鍵が漏えいする深刻な脆弱性が見つかった。CVE-2026-40965として追跡されるこの問題は、攻撃者が認証トークンを偽造できる可能性がある。脆弱性はCloud FoundryのUser Account and Authentication（UAA）コンポーネントに存在する。本来はJWTの検証に必要な公開鍵情報を提供するための「/token_keys」エンドポイントで、実装上の不具合により楕円曲線暗号（EC）の秘密鍵まで返却してしまう。攻撃者は認証なしでこのエンドポイントへアクセスできるため、漏えいした秘密鍵を利用して正規の認証トークンを生成し、認証を回避する恐れがある。なお、この問題はEC鍵に影響し、RSA鍵構成は対象外とされる。影響を受けるのはUAA v76.12.0からv78.12.0までのリリースで、開発元はv78.13.0以降への更新を推奨している。また、グローバル設定テンプレートを利用している環境ではv56.1.0以降への移行が必要となる。修正版では秘密鍵が公開エンドポイント経由で取得できないよう修正されている。 https://securityonline.info/cloud-foundry-key-disclosure-cve-2026-40965/
Post summary
The post reports a serious key‑leak vulnerability in Cloud Foundry UAA, provides concrete remediation steps, and lacks evidence of public PoCs or active exploitation.
0101742.4K
14.5K followersView on X
kokumօtօ@__kokumoto130d
Patch
Cloud FoundryにCVSSスコア10の脆弱性。CVE-2026-40965はJWT署名鍵漏洩の脆弱性で、public/token_keysエンドポイントから楕円曲線秘密鍵が漏洩。修正版提供済み。 https://securityonline.info/cloud-foundry-key-disclosure-cve-2026-40965/
Post summary
Cloud Foundry CVE‑2026‑40965 leaks elliptic‑curve private keys via the public/token_keys endpoint, with a CVSS score of 10; a fix has already been released.
010811.4K
7.6K followersView on X
Daily CyberSecurity@Daily_CyberSec130d
Patch
A critical Cloud Foundry key disclosure flaw leaks Elliptic Curve private keys via a token verification endpoint. Upgrade immediately to mitigate. #Cybersecurity #CloudFoundry #Vulnerability #Cryptography #CloudSecurity #Infosec #PatchManagement https://securityonline.info/cloud-foundry-key-disclosure-cve-2026-40965/ https://t.co/3F7C4zjyOc
Post summary
The post highlights a key disclosure vulnerability in Cloud Foundry that exposes EC private keys through a token verification endpoint and urges users to upgrade immediately to mitigate the risk.
12030627
12.6K followersView on X
CCB Alert@CCBalert136d
Patch
Warning: Critical #vulnerability in Cloud #Foundry UAA patched. CVE-2026-40965, CVSS 10.0, may expose private keys in affected versions. Time to #Patch #Patch #Patch
Post summary
A warning that the critical CVE‑2026‑40965 affecting Cloud Foundry UAA has been patched; users are urged to apply the patch as it could expose private keys.
02000201
7.2K followersView on X
セキュリティ対策Lab@securityLab_jp126d
Disclosure
Cloud Foundry UAAにCVSS 10.0の秘密鍵漏えいの恐れがある脆弱性 CVE-2026-40965、EC鍵利用環境は更新と鍵ローテーションを https://rocket-boys.co.jp/security-measures-lab/cloud-foundry-uaa-cve-2026-40965-vulnerability/ #セキュリティ対策Lab #security #securitynews
Post summary
A new CVE-2026-40965 vulnerability affecting Cloud Foundry UAA has been disclosed, rated CVSS 10.0 with potential secret key leakage; the recommended mitigation is to update the environment and rotate keys.
0000088
428 followersView on X
セキュリティ対策Lab@securityLab_jp126d
Disclosure
Cloud Foundry UAAにCVSS 10.0の秘密鍵漏えいの恐れがある脆弱性 CVE-2026-40965、EC鍵利用環境は更新と鍵ローテーションを https://rocket-boys.co.jp/security-measures-lab/cloud-foundry-uaa-cve-2026-40965-vulnerability/ #セキュリティ対策Lab #security
Post summary
CVE-2026-40965, a high‑severity (CVSS 10.0) secret‑key‑leak vulnerability in Cloud Foundry UAA, has been disclosed with advice to update and rotate keys for mitigation.
0000088
428 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters130d
Patch
CVE-2026-40965 - CRITICAL Cryptographic Key Exposure in Cloud Foundry UAA. EC private keys leaked via /token_keys endpoint. CVSS 10.0. UNPATCHED. Update or disable EC keys immediately. #CVE #CloudFoundry #infosec #CVEAlert FREE UPDATES AND MORE: https://www.valtersit.com/cve/CVE-2026-40965
Post summary
CVE-2026-40965 reveals critical exposure of EC private keys in Cloud Foundry UAA via the /token_keys endpoint, is unpatched with a CVSS score of 10.0; users are urged to update or disable the keys immediately.
0000053
919 followersView on X
Upwind Security MDR@UpwindMDR136d
Patch
🚨 Critical - Private Key Exposure in Cloud Foundry UAA (CVE-2026-40965) Cloud Foundry UAA deployments using Elliptic Curve (EC) keys for JWT token signing are vulnerable to private key exposure. The public /token_keys endpoint, intended only to share public key material, incorrectly exposes the underlying private key components. 👉 RSA configurations are unaffected | Impacted: uaa_release v76.12.0–v78.12.0 & CF Deployment v30.0.0–v56.0.0 | Rotate EC keys and upgrade immediately
Post summary
CVE‑2026‑40965 causes private key exposure through Cloud Foundry UAA’s /token_keys endpoint; users are advised to rotate EC keys and upgrade immediately.
0000065
199 followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2026-40965 Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private k… https://www.cve.org/CVERecord?id=CVE-2026-40965 ----- Traducción: CVE-2026-40965 Clo… http://infoflow.cloud`
Post summary
The message announces CVE‑2026‑40965, a private key exposure vulnerability affecting Cloud Foundry UAA versions 76.12.0 through 78.12.0, and links to the official CVE record.
0000034
79 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-40965 Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private k… https://www.cve.org/CVERecord?id=CVE-2026-40965
Post summary
CVE‑2026‑40965 exposes EC private keys in Cloud Foundry UAA between versions 76.12.0 and 78.12.0, with no PoC, exploit code, active exploitation, or patch information provided.
00000253
57.6K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-40965

yousukezan[verified]@yousukezanPatch

The post reports a serious key‑leak vulnerability in Cloud Foundry UAA, provides concrete remediation steps, and lacks evidence of public PoCs or active exploitation.

kokumօtօ[verified]@__kokumotoPatch

Cloud Foundry CVE‑2026‑40965 leaks elliptic‑curve private keys via the public/token_keys endpoint, with a CVSS score of 10; a fix has already been released.

セキュリティ対策Lab[verified]@securityLab_jpDisclosure

A new CVE-2026-40965 vulnerability affecting Cloud Foundry UAA has been disclosed, rated CVSS 10.0 with potential secret key leakage; the recommended mitigation is to update the environment and rotate keys.

セキュリティ対策Lab[verified]@securityLab_jpDisclosure

CVE-2026-40965, a high‑severity (CVSS 10.0) secret‑key‑leak vulnerability in Cloud Foundry UAA, has been disclosed with advice to update and rotate keys for mitigation.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

CVE-2026-40965 reveals critical exposure of EC private keys in Cloud Foundry UAA via the /token_keys endpoint, is unpatched with a CVSS score of 10.0; users are urged to update or disable the keys immediately.

Upwind Security MDR[verified]@UpwindMDRPatch

CVE‑2026‑40965 causes private key exposure through Cloud Foundry UAA’s /token_keys endpoint; users are advised to rotate EC keys and upgrade immediately.

Daily CyberSecurity@Daily_CyberSecPatch

The post highlights a key disclosure vulnerability in Cloud Foundry that exposes EC private keys through a token verification endpoint and urges users to upgrade immediately to mitigate the risk.

CCB Alert@CCBalertPatch

A warning that the critical CVE‑2026‑40965 affecting Cloud Foundry UAA has been patched; users are urged to apply the patch as it could expose private keys.