Could you try tracing the cf login command and checking to ensure you have
the cloud_controller.admin scope?

$ CF_TRACE=true cf login
...

{"access_token":"[PRIVATE DATA
HIDDEN]","token_type":"bearer","refresh_token":"[PRIVATE DATA
HIDDEN]","expires_in":599,"scope":"openid scim.read cloud_controller.admin
uaa.user routing.router_groups.read cloud_controller.read password.write
cloud_controller.write doppler.firehose
scim.write","jti":"b1bceeed-1c8b-4ea1-b484-ebea1bf62ef1"}
...