CVE-2026-41012: CWE-295: Improper Certificate Validation in Cloud Foundry bosh-vsphere-cpi-release

The vulnerability CVE-2026-41012 in Cloud Foundry's bosh-vsphere-cpi-release arises from improper certificate validation (CWE-295) in the communication between BOSH Director and vCenter. An attacker positioned between these components can impersonate the vCenter REST API endpoint by exploiting the lack of proper certificate validation and pinning. When BOSH Director makes CPI calls, the attacker captures the vCenter administrator's username and password sent via HTTP Basic authentication. Since vCenter credentials provide full administrative control over the virtualization environment, this leads to complete takeover of all virtual machines, datastores, and networks managed by the compromised vCenter instance. The vulnerability affects every CPI call, including routine operations, and cannot be mitigated by simply supplying a CA certificate.

Successful exploitation allows an attacker with network position between BOSH Director and vCenter to capture vCenter administrator credentials. These credentials grant full administrative control over the entire virtualization infrastructure, including all VMs, datastores, and networks managed by the compromised vCenter. This results in complete virtualization infrastructure takeover, impacting potentially hundreds or thousands of virtual machines across multiple deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability stems from improper certificate validation, mitigation requires implementing proper certificate validation and pinning in the communication between BOSH Director and vCenter. Supplying a CA certificate alone is insufficient. Until a fix is available, avoid network configurations that allow interception between BOSH Director and vCenter or use additional network-level protections such as VPNs or dedicated secure channels.