PT-2026-46134 · Cloud Foundry Foundation · Bosh

Published 2026-06-04 · Updated 2026-06-04 · CVE-2026-41860

NVD

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create async endpoint and #send http get request synchronous hard-code OpenSSL::SSL::VERIFY NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials.

Affected versions:

• BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2026-41860

Affected Products

Bosh

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-41860 · Security Note
• https://cloudfoundry.org/blog/cve-2026-41860-missing-tls-verify-on-bosh-monitor · Note