CVE-2026-41860 PUBLISHED

Assigner: vmware
Reserved: 22.04.2026 Published: 04.06.2026 Updated: 04.06.2026

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials.

Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H
CVSS Score: 7.1

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	Low	Integrity	High
Attack Requirements	Present	Availability	None	Availability	High
Privileges Required	Low
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Local	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Cloud Foundry Foundation
Product	BOSH
Versions	Default: unaffected affected from 0 to 282.1.9 (excl.)

References

https://www.cloudfoundry.org/blog/cve-2026-41860-missing-tls-verify-on-bosh-monitor/

Problem Types

CWE-326: Inadequate Encryption Strength CWE

Impacts

A local attacker with low privileges can perform a man-in-the-middle attack to intercept traffic between bosh-monitor and the BOSH director or UAA, stealing Basic-auth credentials or redirecting UAA token requests (confidentiality and integrity impact: HIGH on both vulnerable and subsequent systems).