CVE-2026-59335: CWE-178: Improper Handling of Case Sensitivity in Cloud Foundry UAA

The vulnerability arises because the authorization layer in Cloud Foundry UAA performs a case-sensitive comparison of the system zone identifier, while the MySQL persistence layer uses a case-insensitive collation by default. An attacker with zones.write authority can exploit this mismatch by specifying the system zone identifier in a non-lowercase form (e.g., 'UAA'), causing the authorization check to incorrectly permit access. This allows overwriting the system zone's JWT signing key with attacker-controlled material, enabling forging of JWTs with administrative scopes and complete compromise of UAA and any trusting Cloud Foundry deployment. The issue is specific to MySQL-backed UAA deployments with default collation settings; PostgreSQL and HSQLDB are not vulnerable.

An attacker with zones.write authority can bypass intended access restrictions to the privileged system identity zone, overwrite critical JWT signing keys, and forge tokens with administrator privileges. This results in full compromise of the UAA service and any Cloud Foundry deployments that rely on it for authentication and authorization. The vulnerability does not affect UAA deployments using PostgreSQL or HSQLDB backends.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should review their UAA deployment backend configuration and consider mitigating the risk by avoiding MySQL default collation or restricting zones.write authority. Monitor vendor communications for patches or official mitigations.