# CVE-2026-47828: Cloud Foundry BOSH CLI missing TLS verification in create-env and delete-env

Source: https://junglewise.ai/threats/cve-2026-47828-cloud-foundry-bosh-cli-missing-tls-verification-in-create-env-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-47828 · Severity: high · CVSS 7.1 · Published 2026-07-09

A security flaw in the BOSH command-line tool, used for deploying and managing cloud infrastructure, fails to verify digital certificates during certain setup operations. This allows a nearby attacker on the same network to intercept sensitive credentials and configuration secrets. With this information, an attacker could gain full administrative control over the newly created virtual machines, potentially leading to a complete compromise of the cloud environment.

Technologies: [Cloud Foundry BOSH CLI](https://junglewise.ai/threats/technologies/bosh-cli). Vendors: [Cloud Foundry](https://junglewise.ai/threats/vendors/cloud-foundry).

## Quick answers

**Is CVE-2026-47828 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47828 being exploited in the wild.

**How severe is CVE-2026-47828?** High severity, with a CVSS score of 7.1, published 9 July 2026.

**Which products and versions are affected?** Cloud Foundry BOSH CLI versions prior to v7.10.4.

**Is there a fix for CVE-2026-47828?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47828 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-47828?** Check whether you run Cloud Foundry BOSH CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing TLS certificate verification vulnerability exists in bosh-cli during the execution of 'create-env' and 'delete-env' commands. Although a CA certificate is available in the installation manifest, the CLI does not use it to validate the DAV blobstore's identity. An attacker on an adjacent network can perform a Man-in-the-Middle (MitM) attack to terminate the TLS connection, capture Basic-auth credentials, and access rendered-template archives containing bootstrap secrets. These stolen credentials can then be replayed against the BOSH agent on the legitimate VM to achieve root-level code execution. The issue is resolved in bosh-cli v7.10.4.

## Affected products

- Cloud Foundry bosh-cli versions prior to v7.10.4

## Timeline

- 2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
- 2026-07-09: disclosed: CVE published to NVD

## References

- [https://www.cloudfoundry.org/blog/cve-2026-47828-missing-tls-certificate-verification-in-bosh-cli-allows-root-code-execution-via-man-in-the-middle-credential-replay/](https://www.cloudfoundry.org/blog/cve-2026-47828-missing-tls-certificate-verification-in-bosh-cli-allows-root-code-execution-via-man-in-the-middle-credential-replay/)

## Related threats

- [CloudFoundry BOSH CLI shell injection in SSH and SCP commands](https://junglewise.ai/threats/cve-2026-41857-cloudfoundry-bosh-cli-shell-injection-in-ssh-and-scp-commands)