CVE-2026-41860: Weak Encryption
CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#createasyncendpoint and #sendhttpgetrequestsynchronous hard-code OpenSSL::SSL::VERIFYNONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials.
Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BOSHto a version that resolves this vulnerability.Fixed in v282.1.9 - Configuration
Modify HttpRequestHelper#create_async_endpoint and HttpRequestHelper#send_http_get_request_synchronous to stop hard-coding OpenSSL::SSL::VERIFY_NONE so HTTPS requests verify certificates and prevent MITM credential theft.
BOSH HttpRequestHelper OpenSSL::SSL::VERIFY_NONE = disable (use certificate verification instead)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41860?
The severity of CVE-2026-41860 is rated as high with a score of 8.8.
What kind of attacks are possible due to CVE-2026-41860?
CVE-2026-41860 allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via a man-in-the-middle attack.
How do I fix CVE-2026-41860?
To fix CVE-2026-41860, ensure that OpenSSL's SSL verification is enabled by not hard-coding OpenSSL::SSL::VERIFY_NONE.
Which software is affected by CVE-2026-41860?
CVE-2026-41860 affects the Cloud Foundry Bosh component.
What vulnerability type does CVE-2026-41860 represent?
CVE-2026-41860 is classified under CWE-326, indicating a weak encryption vulnerability.