Is CVE-2026-47828 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47828 being exploited in the wild.

How severe is CVE-2026-47828?

High severity, with a CVSS score of 7.1, published 9 July 2026.

Which products and versions are affected?

Cloud Foundry BOSH CLI versions prior to v7.10.4.

Is there a fix for CVE-2026-47828?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47828 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-47828?

Check whether you run Cloud Foundry BOSH CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47828: Cloud Foundry BOSH CLI missing TLS verification in create-env and delete-env

CVE-2026-47828 · Severity: high · CVSS 7.1 · Published 2026-07-09

A security flaw in the BOSH command-line tool, used for deploying and managing cloud infrastructure, fails to verify digital certificates during certain setup operations. This allows a nearby attacker on the same network to intercept sensitive credentials and configuration secrets. With this information, an attacker could gain full administrative control over the newly created virtual machines, potentially leading to a complete compromise of the cloud environment.

Technologies: Cloud Foundry BOSH CLI. Vendors: Cloud Foundry.

Quick answers

Is CVE-2026-47828 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47828 being exploited in the wild.
How severe is CVE-2026-47828?: High severity, with a CVSS score of 7.1, published 9 July 2026.
Which products and versions are affected?: Cloud Foundry BOSH CLI versions prior to v7.10.4.
Is there a fix for CVE-2026-47828?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47828 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-47828?: Check whether you run Cloud Foundry BOSH CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing TLS certificate verification vulnerability exists in bosh-cli during the execution of 'create-env' and 'delete-env' commands. Although a CA certificate is available in the installation manifest, the CLI does not use it to validate the DAV blobstore's identity. An attacker on an adjacent network can perform a Man-in-the-Middle (MitM) attack to terminate the TLS connection, capture Basic-auth credentials, and access rendered-template archives containing bootstrap secrets. These stolen credentials can then be replayed against the BOSH agent on the legitimate VM to achieve root-level code execution. The issue is resolved in bosh-cli v7.10.4.

Affected products

Cloud Foundry bosh-cli versions prior to v7.10.4

Timeline

2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
2026-07-09: disclosed: CVE published to NVD

References

https://www.cloudfoundry.org/blog/cve-2026-47828-missing-tls-certificate-verification-in-bosh-cli-allows-root-code-execution-via-man-in-the-middle-credential-replay/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.