CVE-2026-47831: Weak Random Number Generator in bosh-windows-stemcell-builder SSH Password Generation

Technical summary

CVE-2026-47831 exploits insufficient randomness in the GenerateRandomPassword function within bosh-windows-stemcell-builder. The function relies on a cryptographically weak random number generator (RNG) rather than a cryptographically secure alternative, producing passwords with predictable patterns or limited entropy. An attacker positioned on the adjacent network (AV:A) can enumerate or brute-force these weaker passwords over SSH (TCP/22) without requiring prior authentication or user interaction. The CVSS 3.0 score of 7.5 reflects high severity across confidentiality, integrity, and availability—an attacker gaining SSH access inherits full system privileges.

Business impact

Compromise of Windows stemcell builders exposes your infrastructure automation pipeline. Attackers gaining SSH access could inject malicious code into stemcells before they're deployed, affecting every instance created from those stemcells. This creates a supply-chain risk: compromised stemcells could be deployed across development, staging, and production environments, leading to persistent compromise of virtual infrastructure. Additionally, attackers may exfiltrate sensitive build artifacts, SSH keys, or credentials stored on builder systems.

Affected systems

Organizations using bosh-windows-stemcell-builder versions prior to v2019.98 are affected. This includes teams using BOSH (Cloud Foundry's deployment tool) to manage Windows stemcells in vSphere, AWS, Azure, GCP, or other environments. The vulnerability is most critical for infrastructure teams where builder systems are accessible from internal networks or where network segmentation between builder systems and user networks is weak.

Exploitability

Exploitability is elevated but not trivial. The attack requires network adjacency (AV:A)—the attacker must be on the same network segment as the stemcell builder—and the attack complexity is rated as high (AC:H), suggesting the weak RNG still requires some computational effort to exploit. However, for well-resourced attackers or those with sustained network access, brute-forcing SSH credentials generated by a weak RNG is feasible. No public exploit code is known to exist, and the vulnerability is not yet on the CISA KEV list, suggesting active exploitation in the wild has not been widely reported, though the risk should not be underestimated.

Remediation

Upgrade bosh-windows-stemcell-builder to version v2019.98 or later. This version addresses the weak RNG issue in the GenerateRandomPassword function. After patching, regenerate all stemcells and redeploy them to environments to ensure no compromised stemcells remain in use. Conduct a review of SSH access logs on affected builder systems for signs of unauthorized access attempts or successful logins during the vulnerable window.

Patch guidance

Apply the upgrade to v2019.98 or later as soon as practically possible. Verify the patch version against the official BOSH Windows stemcell-builder release notes. Test the patched builder in a non-production environment before rolling out to production build pipelines. Because stemcells are foundational artifacts, plan the rebuild and redeployment of all stemcells created with vulnerable versions as part of your patch cycle—this may require coordinating with application deployment teams to minimize disruption. Consider temporarily restricting network access to builder systems during the patching window.

Detection guidance

Monitor SSH login attempts and failures on stemcell builder systems, particularly looking for patterns suggesting brute-force activity (multiple failed authentication attempts from a single source or over a short time window). Audit SSH access logs for unexpected successful logins, especially from internal network ranges outside your typical builder access pattern. Review build logs and artifact manifests to identify which stemcells were created with vulnerable versions. In SIEM or log aggregation tools, correlate SSH auth failures with subsequent successful logins to detect potential compromises. If feasible, enable SSH key-based authentication only (disable password authentication) on builder systems as a compensating control.

Why prioritize this

This vulnerability merits urgent attention despite moderate CVSS complexity because stemcell builders are critical chokepoints in infrastructure automation. Compromise of a builder affects every instance deployed from its stemcells, creating widespread and persistent impact. While the attack requires network adjacency, many organizations place builders on shared internal networks where this assumption is weak. The combination of high confidentiality/integrity/availability impact and the supply-chain amplification effect elevates business risk beyond the raw CVSS score. Organizations should treat this as a priority patch.

Risk score, explained

CVSS 3.0 base score of 7.5 (HIGH) reflects: Attack Vector: Adjacent Network (AV:A)—attacker must share network segment with the vulnerable system; Attack Complexity: High (AC:H)—exploiting weak randomness requires computational effort but is feasible; Privileges Required: None (PR:N)—no prior access needed; User Interaction: None (UI:N)—attack is automatic; confidentiality, integrity, and availability are all rated as High (C:H, I:H, A:H), as successful SSH compromise grants full system control. The score appropriately captures the severity but should be contextually elevated in your risk management if builder systems are inadequately segmented from attacker-reachable networks.

Frequently asked questions