Back to overview

CVE-2026-41859

HIGH
7.8
CVSS 3.1
Description
A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh_api_response_body builds a Net::HTTP client with verify_mode = OpenSSL::SSL::VERIFY_NONE for every director call (/info, /deployments, /deployments/<name>/vms). Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later

Metadata

CVE ID
CVE-2026-41859
State
PUBLISHED
Assigner
vmware
Reserved
2026-04-22 06:22 UTC
Published
2026-06-04 01:51 UTC
Last updated
2026-06-04 12:38 UTC
Primary CWE
CWE-295
CWE-295: Improper Certificate Validation
Vendor / Product
Cloud Foundry Foundation / BOSH
Sources
cve.org  ·  NVD

Severity & Metrics

7.8 HIGH CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Cloud Foundry Foundation BOSH — 0 < 282.1.9
Weakness (CWE)
CWESourceDescription
CWE-295 cna CWE-295: Improper Certificate Validation
CVSS scores (2)
ScoreSeverityVersionSourceVector
7.8 HIGH 3.1 cna CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.1 HIGH 4.0 cna CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H
References (1)
Back to overview