{"id":"CVE-2026-47828","aliases":["EUVD-2026-42514","GHSA-93mr-7m4p-h3cq"],"status":"published","title":"Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay","description":"During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution.\nAffected versions: bosh-cli versions prior to v7.10.4.","severity":{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00286,"percentile":0.21217,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-07-09T06:07:10Z","modified":"2026-10-28T02:30:41Z","products":[{"vendor":"bosh-ecosystem / bosh (bosh-cli)","product":"bosh-cli"},{"vendor":"cloudfoundry","product":"bosh_cli"}],"references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-47828-missing-tls-certificate-verification-in-bosh-cli-allows-root-code-execution-via-man-in-the-middle-credential-replay/","tags":["Vendor Advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47828","tags":["advisory"]},{"url":"https://www.cloudfoundry.org/blog/cve-2026-47828-missing-tls-certificate-verification-in-bosh-cli-allows-root-code-execution-via-man-in-the-middle-credential-replay"},{"url":"https://github.com/advisories/GHSA-93mr-7m4p-h3cq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47828.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47828","title":"Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay","description":"During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution.\nAffected versions: bosh-cli versions prior to v7.10.4.","status":"published","published":"2026-07-09T06:07:10.251Z","modified":"2026-07-09T12:50:23.498Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T13:36:29.327819Z"}],"euvd":[{"id":"EUVD-2026-42514","description":"During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution.\nAffected versions: bosh-cli versions prior to v7.10.4.","status":"published","published":"2026-07-09T06:07:10Z","modified":"2026-07-09T12:50:23Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T18:20:04.523855Z"}],"ghsa":[{"id":"GHSA-93mr-7m4p-h3cq","title":"During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered...","description":"During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution.\nAffected versions: bosh-cli versions prior to v7.10.4.","status":"published","published":"2026-07-09T09:30:28Z","modified":"2026-07-09T09:30:35Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:09:20.981798Z"}],"nvd":[{"id":"CVE-2026-47828","description":"During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution.\nAffected versions: bosh-cli versions prior to v7.10.4.","status":"published","published":"2026-07-09T07:16:23.99Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-47828","title":"Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay","description":"During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution.\nAffected versions: bosh-cli versions prior to v7.10.4.","status":"published","published":"2026-07-09T06:07:10.251Z","modified":"2026-10-28T02:30:41.995766408Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T15:45:06.701612Z"}]}}