CVE-2026-47828
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
A vulnerability in BOSH CLI (versions prior to 7.10.4) causes the client to skip server certificate verification for DAV blobstore during create-env and delete-env operations, allowing a network attacker to intercept Basic-auth credentials and read the rendered-templates archive containing all bootstrap secrets for the new BOSH Director.
Risk Assessment
An attacker can gain root code execution on the new BOSH Director and exfiltrate all bootstrap secrets, leading to a complete compromise of the BOSH environment.
Recommendation
Immediately upgrade BOSH CLI to version 7.10.4 or later. Ensure all installations use proper CA configuration for the DAV blobstore.
Other vulnerabilities in BOSH CLI
See all- CVE-2026-47826Critical
A path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information via the blobs.yml file. Affected versions are prior to v7.10.4.
- CVE-2026-47827High
Command Injection in BOSH CLI tool on Windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities.
- CVE-2026-47829High
An argument injection vulnerability in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned SSH process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation.
- CVE-2026-41857High
A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI prior to 7.10.5.
Original NVD description (English source)
During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.