CVE-2026-41860 — Cloud Foundry Foundation / BOSH

CVE-2026-41860

Cloud Foundry Foundation / BOSH PUBLISHED

Description (CNA)

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials. Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later

Affected (CNA)

Vendor / product	Versions
Cloud Foundry Foundation / BOSH	affected 0 before 282.1.9

CWE

CWE-326

References

https://www.cloudfoundry.org/blog/cve-2026-41860-missing-tls-verify-on-bosh-monitor/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.