Executive brief
A security flaw in BOSH, a tool used for deploying and managing cloud software, allows an attacker positioned on the local network to intercept sensitive administrative credentials. By exploiting a failure to verify secure connections, an attacker can gain full administrative control over the BOSH director and manipulate the list of authorized virtual machines. This could lead to unauthorized access to cloud infrastructure, data theft, or disruption of services.
Technical details
The vulnerability is a case of improper certificate validation (CWE-295) within the nats-sync component of BOSH. Specifically, the `UsersSync#bosh_api_response_body` method initializes a Net::HTTP client with `verify_mode` set to `OpenSSL::SSL::VERIFY_NONE`, disabling TLS certificate verification for calls to the BOSH director. An attacker with man-in-the-middle capabilities can intercept the UAA client secret or Basic auth headers, granting them administrative access. Furthermore, because the unauthenticated `/info` response is used to determine subsequent connection targets, an attacker can redirect authentication requests to a malicious server and tamper with the NATS configuration file. The issue is resolved in BOSH version v282.1.9.
Affected products
- Cloud Foundry Foundation BOSH versions prior to v282.1.9
Timeline
- 2026-06-01: advisory: Initial vulnerability report published by Cloud Foundry Foundation
- 2026-06-04: disclosed: NVD publication date