Cloud Foundry Bosh vulnerabilities

• cloud foundry bosh-vsphere-cpi-release BOSH vSphere CPI Improper Cert Validation CVE-2026-41012 7.7 HighAugust 29, 2026
• cloud foundry bosh Arbitrary Root File Write via Path Traversal in BOSH agent CVE-2026-41861 4.2 MediumAugust 6, 2026
• cloud foundry bosh PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, ... CVE-2026-41011 8.7 HighJune 4, 2026
• cloud foundry bosh A network man-in-the-middle between nats-sync and the BOSH director can steal the director... CVE-2026-41859 7.1 HighJune 4, 2026
• cloud foundry bosh CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token... CVE-2026-41860 7.1 HighJune 4, 2026
• cloud foundry haproxy-boshrelease Security check loophole in HAProxy release (in combination with routing release) in Cloud Foundry... CVE-2024-37082 9.1 CriticalJuly 3, 2024
• cloud foundry bosh system metrics server UAA password may appear in BOSH System Metrics Server process arguments CVE-2020-5422 6.5 MediumOctober 2, 2020
• cloud foundry bosh Bosh Deployment logs leak sensitive information CVE-2019-11271 6.0 MediumJune 18, 2019
• cloud foundry bosh backup and restore BBR could run arbitrary scripts on deployment VMs CVE-2019-3786 7.7 HighApril 24, 2019
• cloud foundry bosh Bosh accepts refresh tokens in place of an access token CVE-2018-11083 8.4 HighOctober 5, 2018