Executive brief
A security flaw in the BOSH command-line tool, used for deploying and managing cloud infrastructure, fails to verify digital certificates during certain setup operations. This allows a nearby attacker on the same network to intercept sensitive credentials and configuration secrets. With this information, an attacker could gain full administrative control over the newly created virtual machines, potentially leading to a complete compromise of the cloud environment.
Technical details
A missing TLS certificate verification vulnerability exists in bosh-cli during the execution of 'create-env' and 'delete-env' commands. Although a CA certificate is available in the installation manifest, the CLI does not use it to validate the DAV blobstore's identity. An attacker on an adjacent network can perform a Man-in-the-Middle (MitM) attack to terminate the TLS connection, capture Basic-auth credentials, and access rendered-template archives containing bootstrap secrets. These stolen credentials can then be replayed against the BOSH agent on the legitimate VM to achieve root-level code execution. The issue is resolved in bosh-cli v7.10.4.
Affected products
- Cloud Foundry bosh-cli versions prior to v7.10.4
Timeline
- 2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
- 2026-07-09: disclosed: CVE published to NVD