CVE-2026-41012
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A traffic interception vulnerability in BOSH Director vCenter CPI allows an attacker positioned between BOSH Director and vCenter to impersonate the vCenter REST API and capture administrator credentials transmitted via HTTP Basic auth, leading to complete virtualization infrastructure takeover.
Risk Assessment
The risk to the organization is critical: capturing vCenter administrator credentials gives the attacker full control over all virtual machines, datastores, and networks managed by the CPI, potentially affecting hundreds or thousands of VMs across multiple environments.
Recommendation
Immediately implement proper certificate validation and pinning in the BOSH Director to vCenter communication, and consider using stronger authentication than HTTP Basic auth. Also review network traffic for potential credential interception.
Related vulnerabilities
- CVE-2026-120209Critical
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.
- CVE-2026-120201Critical
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
- CVE-2026-118235Critical
The SimpleForm plugin for WordPress (versions up to and including 3.10.2) is vulnerable to arbitrary file upload via the handle_upload function. Missing a server-side file key allowlist and pre-sanitization extension derivation allows a trailing-dot filename to bypass all extension and MIME validation, enabling unauthenticated attackers to upload executable files and achieve remote code execution. The only access control is a nonce printed into every public form's data-nonce attribute, trivially obtainable by any unauthenticated visitor.
- CVE-2026-103882Critical
The Acadlix LMS plugin for WordPress (versions up to and including 1.1.9) is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function. Authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server, potentially leading to remote code execution when critical files such as wp-config.php are deleted. The route's permission callback only verifies a generic wp_rest nonce emitted in the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.
- CVE-2026-119096Critical
The Uncanny Toolkit for LearnDash plugin for WordPress (up to 3.8.2) is vulnerable to Authentication Bypass via the 'email' parameter in uo_login_action(). A parser-differential flaw allows skipping account verification by using a raw string for lookup and a sanitized string for login. This lets unauthenticated attackers log in to unverified or suspended accounts if they know the credentials.
- CVE-2026-116512Critical
The Project Manager – AI Powered Project Management plugin for WordPress (up to 4.1.1) is vulnerable to Remote Code Execution via the 'id' parameter. The unsanitized value is concatenated into a validation rule string and then invoked as a dynamic PHP function without allowlist checks. This allows unauthenticated attackers to execute code on the server.
- CVE-2026-89270Critical
The Popup Builder plugin for WordPress in versions up to and including 4.4.5 does not properly verify that a user is authorized to perform an action. An unauthenticated attacker can trash all published popups on the site with a single GET request, amplified by a second flaw in SGPopup::find() that causes the trash branch to fire against every popup simultaneously.
- CVE-2026-116557Critical
The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.5 lacks a capability check in the wpbs_action_ajax_calendar_remove_note() function. An authenticated attacker with Subscriber-level access or above can delete arbitrary calendar notes belonging to any calendar.
- CVE-2026-109220Critical
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin in versions up to and including 7.1.1 is vulnerable to PHP Object Injection via the 'customer_note' parameter. The checkout field is insufficiently sanitized and passed to unserialize() without validation, allowing unauthenticated attackers to execute code on the server.
- CVE-2026-117656Critical
The pow-auth Assent library's Sign in with Apple strategy trusts the browser-supplied 'user' parameter, which the client controls. That parameter is merged over the verified ID token claims, allowing an unauthenticated remote attacker to impersonate another user. Affects versions from 0.1.25 before 0.3.2.
Original NVD description (English source)
Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can intercept traffic between the BOSH Director and vCenter can establish a malicious server impersonating the vCenter REST API. When the BOSH Director makes CPI calls to perform routine cloud infrastructure operations, the attacker captures the vCenter administrator username and password transmitted via HTTP Basic authentication. The vulnerability stems from insufficient authentication security in the communication protocol between BOSH Director and vCenter. While HTTPS may be used, the lack of proper certificate validation and pinning allows attackers to successfully impersonate vCenter endpoints. Because vCenter credentials typically grant full administrative control over the entire virtualization estate, successful credential capture yields complete takeover of every VM, datastore, and network the CPI manages. This exposure exists on every CPI call (including routine deployment operations, not just when tags are configured) and cannot be mitigated by supplying a CA certificate alone. The attack impacts all infrastructure managed by the compromised vCenter instance, potentially affecting hundreds or thousands of VMs across multiple deployments and environments.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS