Executive brief
A security flaw in the tool used to build Windows base images for Cloud Foundry environments allows for the creation of weak administrative passwords. Because these passwords are generated using a predictable method, an attacker on the same network could potentially guess the credentials and gain full remote access to the system via SSH. This could lead to unauthorized access to sensitive data or the disruption of cloud operations.
Technical details
The vulnerability stems from the use of a cryptographically weak random number generator (RNG) within the GenerateRandomPassword function of the bosh-windows-stemcell-builder. This lack of entropy results in predictable password generation for Windows stemcells. An attacker with network access to the affected instances (specifically port 22/TCP) can exploit this predictability to perform a successful brute-force attack against the SSH service. Successful exploitation grants the attacker unauthorized remote access with the privileges of the generated account. The issue is resolved in version v2019.98.
Affected products
- Cloud Foundry Foundation bosh-windows-stemcell-builder prior to v2019.98
Timeline
- 2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
- 2026-07-09: disclosed: CVE published to NVD dataset