CVE-2026-47828: Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay
During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bosh-clito a version that resolves this vulnerability.Fixed in v7.10.4 - Configuration
Ensure bosh-cli verifies the server certificate for the DAV blobstore HTTPS endpoint during bosh create-env and bosh delete-env, using the CA certificate for that endpoint provided in the installation manifest.
bosh-cli TLS server certificate verification when uploading DAV blobstore artifacts over HTTPS (bosh create-env / bosh delete-env) = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47828?
The severity of CVE-2026-47828 is high, with a score of 7.1.
How do I fix CVE-2026-47828?
To fix CVE-2026-47828, ensure that the BOSH CLI correctly verifies TLS server certificates during the create-env and delete-env commands.
What does CVE-2026-47828 exploit?
CVE-2026-47828 exploits the lack of TLS certificate verification in the BOSH CLI, allowing potential root code execution through man-in-the-middle attacks.
Which software is affected by CVE-2026-47828?
CVE-2026-47828 affects the BOSH CLI software.
What impact does CVE-2026-47828 have on user data?
CVE-2026-47828 allows for the exposure of sensitive user credentials and data through credential replay in a man-in-the-middle attack.