Read the docs
TI-2026-30270 Aliases CVE-2026-41860GHSA-fqm2-p6px-f54c

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA…

Priority LOW 32CWE-326Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-326.

Summary

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials. Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00074 0th percentileScored 2026-11-07
Fix Fixed BOSH (Cloud Foundry Foundation): 282.1.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cloud Foundry FoundationBOSHbefore 282.1.9282.1.9Patch availableCNA

Remediation

  • Fix · CNA BOSH (Cloud Foundry Foundation) Fixed in 282.1.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cloud Foundry Foundation BOSH 282.1.9

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-30269 Improper certificate validation in Cloud Foundry Foundation BOSHPriority LOW 32
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41860
  2. 2026-10-03 Alias added: GHSA-fqm2-p6px-f54c

References

Other 1

  • TI-2026-29616 Information disclosure in Cloud Foundry Foundation uaa_release CVSS 4.0CRITICAL 10.0
  • TI-2026-35291 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin CVSS 4.0CRITICAL 9.2
  • TI-2026-29615 Improper authentication in Cloud Foundry Foundation log-cache_release CVSS 3.1HIGH 7.5
  • TI-2026-35283 Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite CVSS 4.0HIGH 8.5
  • TI-2026-35280 CVE-2026-47827 – BOSH CLI Powershell Injection CVSS 3.1HIGH 7.5
  • TI-2026-29662 OS command injection in Cloud Foundry Foundation BOSH CVSS 4.0HIGH 8.7
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences