BOSH vulnerabilities

3 known vulnerabilities in BOSH from Cloud Foundry Foundation. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  BOSH: Inadequate Encryption Strength

  CVE-2026-41860Jun 4, 2026Cloud Foundry Foundation

  CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to interce

• 7.8 High severity

  BOSH: Improper Certificate Validation

  CVE-2026-41859Jun 4, 2026Cloud Foundry Foundation

  A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administr

• 8.2 High severity

  BOSH: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-41011Jun 4, 2026Cloud Foundry Foundation

  PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh,