PT-2026-46134 · Bosh · Bosh

CVE-2026-41860 · Published 2026-06-04 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BOSH versions prior to 282.1.9

Description An issue in BOSH allows a local attacker to perform Man-in-the-Middle (MITM) attacks to steal Basic-auth credentials or redirect UAA token requests. This occurs because the create async endpoint() and send http get request synchronous() functions within the HttpRequestHelper hard-code the OpenSSL::SSL::VERIFY NONE setting, which disables SSL certificate verification for outgoing HTTP requests. An attacker with local network access can intercept traffic between the bosh-monitor and the BOSH director or UAA.

Recommendations Update to version 282.1.9 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2026-41860

Affected Products

Bosh

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-41860 · Security Note
• https://t.me/cveNotify/213335 · Telegram Post
• https://twitter.com/HugoValters/status/2063788101084815794 · Twitter Post
• https://t.me/CVEtracker/55779 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1twrslv/critical_bosh_vulnerability_exposes_users_to · Reddit Post
• https://cloudfoundry.org/blog/cve-2026-41860-missing-tls-verify-on-bosh-monitor · Note