The vulnerability allows an attacker positioned between UAA and its LDAP directory to bypass hostname verification during StartTLS, a flaw classified as CWE‑297 (Improper Validation of Certificate Authority Path). By presenting any certificate from a trusted CA, the attacker can impersonate the directory, capture LDAP bind passwords and every end‑user password transmitted via simple‑bind authentication, and forge group memberships that grant admin scopes. This results in privilege escalation and credential theft for all users authenticated through LDAP over StartTLS.

Affected deployments include the CloudFoundry Foundation’s Cf‑deployment versions earlier than 56.2.0 and CloudFoundry Foundation UAA versions earlier than 78.13.0. Any CloudFoundry installation that authenticates users against an LDAP directory over StartTLS is at risk.

The CVSS score of 8.3 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to be in the network path between UAA and the LDAP server, enabling a man‑in‑the‑middle takeover. Once positioned, the attacker can establish a StartTLS session, supply a forged certificate to bypass hostname verification, read bind credentials, and alter group memberships to elevate privileges.