Executive brief
BOSH, a tool used for deploying and managing cloud software, contains a security flaw in its monitoring component. A local attacker can intercept internal communications to steal login credentials or redirect security token requests. This could lead to unauthorized access to the management infrastructure and sensitive customer data.
Technical details
A CWE-326 vulnerability exists in BOSH due to the hard-coding of 'OpenSSL::SSL::VERIFY_NONE' within the HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous methods. This lack of certificate validation allows a local attacker with low privileges to perform a Man-in-the-Middle (MITM) attack on traffic between bosh-monitor and the BOSH director or UAA. Successful exploitation enables the theft of Basic-auth credentials or the redirection of UAA token requests. The issue is resolved in BOSH version v282.1.9.
Affected products
- Cloud Foundry Foundation BOSH versions prior to v282.1.9
Timeline
- 2026-06-01: advisory: Cloud Foundry Foundation published the security advisory.
- 2026-06-04: disclosed: NVD published the CVE record.
- 2026-06-01: patched: Fixed in version v282.1.9.