CVE-2025-22246lowCWE-532

CVE-2025-22246: low-severity vulnerability in Cloud Foundry UAA

CVE-2025-22246 – UAA Private Key Exposure

Published

Follow this CVE+ Monitor UAA+ Monitor CF Deployment

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3epss 0.2%
Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Affected products
Cloud Foundry · CF deploymentCloud Foundry · UAA
Related CVEs — Cloud Foundry UAA

In the same product, most dangerous first.

CVE-2018-15761CRITICALUAA Privilege EscalationEPSS 1.7%CVE-2018-11082MEDIUMCloud Foundry UAA MFA does not prevent brute force of MFA codeEPSS 1.1%CVE-2023-34061HIGHCVE-2023-34061 – Gorouter route pruningEPSS 0.5%CVE-2026-59335HIGHCase-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA CompromiseEPSS 0.5%CVE-2020-5402HIGHUAA fails to check the state parameter when authenticating with external IDPsEPSS 0.5%CVE-2026-59358HIGHUAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant typeEPSS 0.4%