Is CVE-2026-41859 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41859 being exploited in the wild.

How severe is CVE-2026-41859?

High severity, with a CVSS score of 7.8, published 4 June 2026.

Which products and versions are affected?

Cloud Foundry Foundation BOSH versions prior to v282.1.9.

Is there a fix for CVE-2026-41859?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41859 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-41859?

Check whether you run Cloud Foundry Foundation BOSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41859: Cloud Foundry BOSH improper certificate validation in nats-sync

CVE-2026-41859 · Severity: high · CVSS 7.8 · Published 2026-06-04

A security flaw in BOSH, a tool used for deploying and managing cloud software, allows an attacker positioned on the local network to intercept sensitive administrative credentials. By exploiting a failure to verify secure connections, an attacker can gain full administrative control over the BOSH director and manipulate the list of authorized virtual machines. This could lead to unauthorized access to cloud infrastructure, data theft, or disruption of services.

Technologies: Cloud Foundry Foundation BOSH. Vendors: Cloud Foundry Foundation.

Quick answers

Is CVE-2026-41859 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41859 being exploited in the wild.
How severe is CVE-2026-41859?: High severity, with a CVSS score of 7.8, published 4 June 2026.
Which products and versions are affected?: Cloud Foundry Foundation BOSH versions prior to v282.1.9.
Is there a fix for CVE-2026-41859?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41859 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-41859?: Check whether you run Cloud Foundry Foundation BOSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a case of improper certificate validation (CWE-295) within the nats-sync component of BOSH. Specifically, the `UsersSync#bosh_api_response_body` method initializes a Net::HTTP client with `verify_mode` set to `OpenSSL::SSL::VERIFY_NONE`, disabling TLS certificate verification for calls to the BOSH director. An attacker with man-in-the-middle capabilities can intercept the UAA client secret or Basic auth headers, granting them administrative access. Furthermore, because the unauthenticated `/info` response is used to determine subsequent connection targets, an attacker can redirect authentication requests to a malicious server and tamper with the NATS configuration file. The issue is resolved in BOSH version v282.1.9.

Affected products

Cloud Foundry Foundation BOSH versions prior to v282.1.9

Timeline

2026-06-01: advisory: Initial vulnerability report published by Cloud Foundry Foundation
2026-06-04: disclosed: NVD publication date

References

https://www.cloudfoundry.org/blog/cve-2026-41859-missing-tls-in-nats-sync/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.