# CVE-2026-41012: Cloud Foundry BOSH VSphere CPI certificate validation bypass

Source: https://junglewise.ai/threats/cve-2026-41012-cloud-foundry-bosh-vsphere-cpi-certificate-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41012 · Severity: high · CVSS 7.7 · Published 2026-08-29

BOSH Director is infrastructure-as-code software that manages virtual machine deployment across vCenter environments. A weakness in how it validates secure connections to vCenter allows attackers on the network to intercept communications and steal vCenter administrator credentials, leading to complete control of all virtual machines, storage, and networks managed by that instance.

Vendors: [Cloud Foundry Foundation](https://junglewise.ai/threats/vendors/cloud-foundry-foundation).

## Quick answers

**Is CVE-2026-41012 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41012 being exploited in the wild.

**How severe is CVE-2026-41012?** High severity, with a CVSS score of 7.7, published 29 August 2026.

**Which products and versions are affected?** Cloud Foundry Foundation BOSH VSphere CPI All versions prior to v98.0.6.

**Is there a fix for CVE-2026-41012?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41012 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-41012?** Check whether you run Cloud Foundry Foundation BOSH VSphere CPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper certificate validation flaw in BOSH VSphere CPI's communication with vCenter REST API. Although HTTPS is used, insufficient certificate validation and lack of certificate pinning allow attackers positioned on the network path between BOSH Director and vCenter to perform man-in-the-middle (MITM) attacks. Attackers can impersonate the vCenter API endpoint and capture HTTP Basic authentication credentials (username/password) transmitted in every CPI call. Since vCenter credentials grant administrative access to the entire virtualization infrastructure, successful exploitation enables complete takeover of all managed VMs, datastores, and networks. Affected versions are BOSH VSphere CPI prior to v98.0.6; patches have been made available.

## Affected products

- Cloud Foundry Foundation BOSH VSphere CPI All versions prior to v98.0.6

## Timeline

- 2026-08-27: advisory: Security advisory published by Cloud Foundry Foundation
- 2026-08-29: other: CVE-2026-41012 published

## References

- [https://www.cloudfoundry.org/blog/cve-2026-41012-bosh-vsphere-cpi-improper-cert-validation/](https://www.cloudfoundry.org/blog/cve-2026-41012-bosh-vsphere-cpi-improper-cert-validation/)