# CVE-2026-41860: Cloud Foundry BOSH insecure TLS verification in bosh-monitor

Source: https://junglewise.ai/threats/cve-2026-41860-cloud-foundry-bosh-insecure-tls-verification-in-bosh-monitor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-41860 · Severity: high · CVSS 8.8 · Published 2026-06-04

BOSH, a tool used for deploying and managing cloud software, contains a security flaw in its monitoring component. A local attacker can intercept internal communications to steal login credentials or redirect security token requests. This could lead to unauthorized access to the management infrastructure and sensitive customer data.

Technologies: [Cloud Foundry Foundation BOSH](https://junglewise.ai/threats/technologies/bosh). Vendors: [Cloud Foundry Foundation](https://junglewise.ai/threats/vendors/cloud-foundry-foundation).

## Quick answers

**Is CVE-2026-41860 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41860 being exploited in the wild.

**How severe is CVE-2026-41860?** High severity, with a CVSS score of 8.8, published 4 June 2026.

**Which products and versions are affected?** Cloud Foundry Foundation BOSH versions prior to v282.1.9.

**Is there a fix for CVE-2026-41860?** A patch was published on 2026-06-01: Fixed in version v282.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41860 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-41860?** Check whether you run Cloud Foundry Foundation BOSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CWE-326 vulnerability exists in BOSH due to the hard-coding of 'OpenSSL::SSL::VERIFY_NONE' within the HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous methods. This lack of certificate validation allows a local attacker with low privileges to perform a Man-in-the-Middle (MITM) attack on traffic between bosh-monitor and the BOSH director or UAA. Successful exploitation enables the theft of Basic-auth credentials or the redirection of UAA token requests. The issue is resolved in BOSH version v282.1.9.

## Affected products

- Cloud Foundry Foundation BOSH versions prior to v282.1.9

## Timeline

- 2026-06-01: advisory: Cloud Foundry Foundation published the security advisory.
- 2026-06-04: disclosed: NVD published the CVE record.
- 2026-06-01: patched: Fixed in version v282.1.9.

## References

- [https://www.cloudfoundry.org/blog/cve-2026-41860-missing-tls-verify-on-bosh-monitor/](https://www.cloudfoundry.org/blog/cve-2026-41860-missing-tls-verify-on-bosh-monitor/)

## Related threats

- [Cloud Foundry BOSH improper certificate validation in nats-sync](https://junglewise.ai/threats/cve-2026-41859-cloud-foundry-bosh-improper-certificate-validation-in-nats-sync)
- [Cloud Foundry BOSH command injection in PackagePersister](https://junglewise.ai/threats/cve-2026-41011-cloud-foundry-bosh-command-injection-in-packagepersister)