CVE-2026-41859: High severity Cloud Foundry Bosh vulnerability
A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#boshapiresponsebody builds a Net::HTTP client with verifymode = OpenSSL::SSL::VERIFYNONE for every director call (/info, /deployments, /deployments/<name>/vms).
Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BOSHto a version that resolves this vulnerability.Fixed in v282.1.9 - Configuration
Change UsersSync#bosh_api_response_body to not use verify_mode = OpenSSL::SSL::VERIFY_NONE for director calls (/info, /deployments, /deployments/<name>/vms); enable certificate verification instead to prevent man-in-the-middle attacks.
UsersSync (bosh_api_response_body) Net::HTTP client SSL verification mode (verify_mode) = OpenSSL::SSL::VERIFY_NONE - Operational
Assume director credentials may have been exposed (Basic auth header or UAA client secret); rotate/replace the stolen director credentials after upgrading.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41859?
The severity of CVE-2026-41859 is high with a score of 7.8.
How do I fix CVE-2026-41859?
To fix CVE-2026-41859, ensure that TLS is configured properly between nats-sync and the BOSH director.
What systems are affected by CVE-2026-41859?
CVE-2026-41859 affects the Cloud Foundry Bosh system.
What type of attack does CVE-2026-41859 involve?
CVE-2026-41859 involves a network man-in-the-middle attack.
What are the consequences of CVE-2026-41859?
The consequences of CVE-2026-41859 include the potential theft of director credentials and tampering with VM authorization files.