Vulnerability · Published Jun 4, 2026 · Assigned by vmware
CVE-2026-41859
High 7.8
In plain English
A high-severity improper certificate validation in BOSH from Cloud Foundry Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh_api_response_body builds a Net::HTTP client with verify_mode = OpenSSL::SSL::VERIFY_NONE for every director call (/info, /deployments, /deployments/<name>/vms). Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloud Foundry Foundation | BOSH | 0 – before 282.1.9 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H