CVE-2026-40965 is a critical vulnerability in Cloud Foundry Foundation's uaa_release component affecting versions 76.12.0 through 78.12.0. The vulnerability involves the unintended exposure of Elliptic Curve (EC) private keys through the /token_keys endpoint, which is publicly accessible and designed to provide only public key material for JWT token verification. This exposure compromises the confidentiality of private keys used in JWT signing, potentially allowing unauthorized actors to forge tokens or decrypt sensitive data. The vulnerability does not affect deployments using RSA keys for JWT signing. The issue is resolved in uaa_release version 78.13.0 and CF Deployment version 56.1.0 or later, which includes the patched uaa_release.

The exposure of EC private keys through a public endpoint severely compromises the security of JWT token signing in affected deployments. Unauthorized actors could obtain private keys, enabling them to create forged tokens or decrypt sensitive information, leading to potential unauthorized access and data breaches. The vulnerability has a CVSS 4.0 score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available and should be applied by upgrading to uaa_release version 78.13.0 or later. For Cloud Foundry deployments, upgrade to version 56.1.0 or later, which bundles the patched uaa_release. Deployments using EC keys for JWT signing must prioritize this update to prevent private key exposure. RSA key configurations are not affected by this vulnerability. Patch status is confirmed by the vendor advisory specifying fixed versions.