PT-2026-46133 · Cloud Foundry Foundation · Bosh

Published 2026-06-04 · Updated 2026-06-04 · CVE-2026-41859

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh api response body builds a Net::HTTP client with verify mode = OpenSSL::SSL::VERIFY NONE for every director call (/info, /deployments, /deployments//vms).

Affected versions:

• BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-41859

Affected Products

Bosh

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-41859 · Security Note
• https://cloudfoundry.org/blog/cve-2026-41859-missing-tls-in-nats-sync · Note