CVE-2026-47828 describes an improper certificate validation vulnerability (CWE-295) in the BOSH-Ecosystem's bosh-cli tool. When executing bosh create-env or bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to a VM's DAV blobstore over HTTPS but fails to verify the server's TLS certificate even though a CA certificate is provided in the installation manifest. This allows a network attacker to perform a man-in-the-middle attack, terminate the TLS connection, harvest Basic-auth credentials, and read sensitive bootstrap secrets. The attacker can then replay these credentials against the VM's agent to achieve root code execution. The vulnerability affects bosh-cli versions prior to 7.10.4. The CVSS 4.0 score is 8.9, indicating high severity.

An attacker with network access can intercept and terminate TLS connections to the DAV blobstore endpoint, harvest Basic-auth credentials, and obtain rendered templates containing all bootstrap secrets for the new BOSH Director. Using these credentials, the attacker can replay authentication to the VM's agent, leading to root-level code execution on the VM. This compromises the confidentiality and integrity of the deployment process and the affected systems.

A fix is available in bosh-cli version 7.10.4 and later. Users should upgrade to version 7.10.4 or newer to ensure proper certificate validation during bosh create-env and bosh delete-env operations. Patch status is not explicitly stated in the vendor advisory, but the affected versions are prior to 7.10.4, indicating that upgrading to 7.10.4 or later remediates the issue.