CVE-2026-47828: CWE-295 Improper Certificate Validation in BOSH-Ecosystem / BOSH (bosh-cli) bosh-cli
During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.
AI Analysis
Technical Summary
CVE-2026-47828 is an improper certificate validation vulnerability (CWE-295) in the BOSH-Ecosystem's bosh-cli tool. During the execution of 'bosh create-env' and 'bosh delete-env', the CLI uploads compiled CPI packages and rendered job templates to a new VM's DAV blobstore over HTTPS but fails to verify the server's TLS certificate. This occurs even though a CA certificate for the endpoint is present in the installation manifest. An attacker positioned on the network can terminate the TLS connection, capture Basic-auth credentials, and access the rendered-templates archive containing bootstrap secrets for the new BOSH Director. The attacker can then replay credentials against the VM's agent to achieve root code execution. This vulnerability affects bosh-cli versions prior to 7.10.4.
Potential Impact
Exploitation allows a network attacker to intercept and terminate TLS connections, harvest authentication credentials, and access sensitive bootstrap secrets. This can lead to unauthorized root code execution on the targeted VM, compromising the BOSH Director environment.
Mitigation Recommendations
A fix is available in bosh-cli version 7.10.4 and later. Users should upgrade to version 7.10.4 or newer to ensure proper certificate validation and prevent this vulnerability. Patch status is not explicitly stated in the vendor advisory content, but the affected versions are clearly identified as prior to 7.10.4, indicating that upgrading to 7.10.4 or later remediates the issue.
CVE-2026-47828: CWE-295 Improper Certificate Validation in BOSH-Ecosystem / BOSH (bosh-cli) bosh-cli
Description
During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.
CVSS v4.0
Score 8.9high
Affected software
pkg:github/cloudfoundry/bosh-cliRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47828 is an improper certificate validation vulnerability (CWE-295) in the BOSH-Ecosystem's bosh-cli tool. During the execution of 'bosh create-env' and 'bosh delete-env', the CLI uploads compiled CPI packages and rendered job templates to a new VM's DAV blobstore over HTTPS but fails to verify the server's TLS certificate. This occurs even though a CA certificate for the endpoint is present in the installation manifest. An attacker positioned on the network can terminate the TLS connection, capture Basic-auth credentials, and access the rendered-templates archive containing bootstrap secrets for the new BOSH Director. The attacker can then replay credentials against the VM's agent to achieve root code execution. This vulnerability affects bosh-cli versions prior to 7.10.4.
Potential Impact
Exploitation allows a network attacker to intercept and terminate TLS connections, harvest authentication credentials, and access sensitive bootstrap secrets. This can lead to unauthorized root code execution on the targeted VM, compromising the BOSH Director environment.
Mitigation Recommendations
A fix is available in bosh-cli version 7.10.4 and later. Users should upgrade to version 7.10.4 or newer to ensure proper certificate validation and prevent this vulnerability. Patch status is not explicitly stated in the vendor advisory content, but the affected versions are clearly identified as prior to 7.10.4, indicating that upgrading to 7.10.4 or later remediates the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- vmware
- Date Reserved
- 2026-05-20T10:00:48.931Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4f46b8c9d9e3dbe3ae73e4
Added to database: 07/09/2026, 06:59:04 UTC
Last enriched: 07/16/2026, 10:18:28 UTC
Last updated: 08/22/2026, 22:52:14 UTC
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.