CVE-2026-47828: BOSH CLI TLS Certificate Validation Bypass – Critical Credential Harvesting Risk

Technical summary

CVE-2026-47828 is a certificate validation bypass in BOSH CLI versions prior to v7.10.4. During bosh create-env and bosh delete-env operations, the tool uploads compiled CPI packages and rendered job templates to a DAV blobstore endpoint over HTTPS. Despite having a CA certificate available in the installation manifest, the CLI does not verify the server's certificate chain, permitting network-level man-in-the-middle attacks. An attacker can intercept the HTTPS session, harvest Basic-auth credentials transmitted in cleartext over the compromised channel, extract the rendered-templates archive (which includes bootstrap secrets such as API keys, passwords, and certificates), and subsequently replay those credentials against the target VM's agent endpoint for root command execution.

Business impact

Organizations deploying or updating BOSH Directors via CLI in untrusted network segments face immediate exposure to credential harvesting and post-deployment compromise. Since the stolen credentials provide root access to newly provisioned infrastructure, attackers can establish persistent footholds before any application workloads are deployed. This undermines the security posture of Cloud Foundry platforms and any infrastructure managed through BOSH, potentially affecting hundreds or thousands of downstream VMs and containers. The attack window occurs during deployment—a high-risk operation that may be performed by CI/CD systems or infrastructure automation.

Affected systems

BOSH CLI versions prior to v7.10.4 are vulnerable. This affects all users and automated systems that rely on bosh create-env or bosh delete-env to provision or decommission BOSH Directors. The vulnerability is not version-gated by operating system or deployment target; any environment where the affected CLI version communicates with a DAV blobstore endpoint is at risk.

Exploitability

The attack requires network access to the data path between the CLI client and the blobstore endpoint (on-path network position). Because Basic-auth credentials and rendered templates are transmitted in the intercepted HTTPS session without certificate validation, the attacker need not compromise the endpoint or perform DNS hijacking—packet-level interception suffices. This makes the vulnerability exploitable in shared or adversary-controlled networks (corporate WiFi, public cloud VPCs with lateral movement, ISP-level eavesdropping). No user interaction beyond running standard deployment commands is required. The CVSS score of 8.8 (HIGH) reflects high confidentiality and integrity impact; the attack is practical in common network scenarios.

Remediation

Upgrade BOSH CLI to version v7.10.4 or later, which implements proper TLS certificate validation for DAV blobstore endpoints. After patching, verify that new deployments enforce certificate pinning or validation by reviewing CLI logs for certificate verification events. In parallel, rotate all secrets that may have been exposed via prior unpatched deployments, including bootstrap credentials, API keys, and certificates stored in rendered templates.

Patch guidance

Prioritize upgrading BOSH CLI in CI/CD pipelines, infrastructure-as-code workflows, and operator toolchains before any additional bosh create-env or bosh delete-env operations. The patch should be tested in a staging environment to confirm compatibility with your BOSH manifests and network configuration. Verify that the CA certificate path in your manifest is correctly specified and accessible to the CLI after upgrade. Consider requiring signed commits or container image verification to ensure that patched CLI versions are in use.

Detection guidance

Monitor network traffic for unsigned TLS handshakes on ports used by DAV blobstore endpoints (typically 25555 or custom ports specified in manifests). Look for TLS certificate validation errors or warnings in BOSH CLI logs during create-env and delete-env operations—patched versions will emit these upon certificate mismatch. Review CLI audit logs and CI/CD job records to identify any deployments using unpatched versions. Inspect rendered job templates and bootstrap secret archives for unauthorized access or modification timestamps. In environments with network intrusion detection, alert on mid-stream TLS connection resets initiated by clients (indicative of MITM termination).

Why prioritize this

This vulnerability combines high impact (root code execution via credential replay), practical exploitability (network-level MITM), and wide blast radius (affects all new BOSH Director deployments). The attack occurs at infrastructure bootstrap—a critical moment when defenses are minimal and attacker persistence becomes difficult to detect. Organizations using BOSH to manage Cloud Foundry or other large-scale infrastructure should treat patching as urgent.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) network-adjacent attack vector requiring no special privileges, (2) low complexity (straightforward TLS interception), (3) high confidentiality impact (credential and secret harvesting), (4) high integrity impact (ability to execute arbitrary code via credential replay), and (5) high availability impact (potential to disrupt deployed infrastructure). The score does not include privilege escalation because the credentials already grant administrative access. Real-world risk is heightened by the bootstrap context—attackers gain access to systems before they are fully hardened.

Frequently asked questions