BOSH CLI HTTPS Certificate Verification Bypass

Executive Summary

CVE-2026-47828 is a high-severity vulnerability in bosh-cli versions prior to v7.10.4. During the execution of the commands 'bosh create-env' and 'bosh delete-env', the CLI uploads compiled CPI packages and rendered job templates to a new VM's DAV blobstore over HTTPS without verifying the server's TLS certificate, even though a CA certificate is available.

Because the server certificate is not validated, a network attacker positioned as a man-in-the-middle can intercept the TLS connection, steal Basic-auth credentials, and access the rendered-templates archive. This archive contains all bootstrap secrets for the new BOSH Director. The attacker can then replay the stolen credentials against the real VM's agent, resulting in root-level code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized root-level code execution on the affected VM. An attacker can intercept sensitive credentials and secrets, which compromises the security of the BOSH Director environment.

• Loss of confidentiality due to exposure of bootstrap secrets.
• Loss of integrity and control by allowing an attacker to execute arbitrary code as root.
• Potential disruption of services managed by the BOSH Director.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the bosh-cli to version v7.10.4 or later.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a network attacker to intercept TLS connections and harvest Basic-auth credentials along with sensitive bootstrap secrets for the BOSH Director. Such unauthorized access and potential root code execution can lead to exposure and compromise of sensitive data.

The exposure of sensitive credentials and secrets could result in violations of data protection regulations such as GDPR and HIPAA, which mandate strict controls over access to personal and sensitive information. Failure to verify server certificates and prevent man-in-the-middle attacks undermines the confidentiality and integrity requirements of these standards.

Therefore, organizations using affected versions of bosh-cli prior to v7.10.4 may face compliance risks if this vulnerability is exploited, as it compromises secure handling of sensitive data and credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs because the bosh-cli versions prior to v7.10.4 do not verify the server TLS certificate when uploading compiled CPI packages and rendered job templates during the execution of `bosh create-env` and `bosh delete-env` commands.

To detect this vulnerability on your system, you can check the version of your bosh-cli tool to see if it is older than v7.10.4.

• Run `bosh --version` or `bosh-cli --version` to determine the installed version.

Additionally, monitoring network traffic for HTTPS connections from bosh-cli to the VM's DAV blobstore without proper TLS certificate validation could indicate exploitation attempts, but specific commands for this are not provided in the available resources.

Useful 0 Not Useful 0