CVE-2026-41859

Name of the Vulnerable Software and Affected Versions BOSH versions prior to 282.1.9

Description A network man-in-the-middle between nats-sync and the BOSH director can steal director credentials, such as the Basic auth header or UAA client secret, and tamper with the VM list written into the NATS authorization file. Stolen credentials provide administrative director access. This occurs because the bosh api response body() function in UsersSync builds a Net::HTTP client with verify mode set to OpenSSL::SSL::VERIFY NONE for director calls to the endpoints "/info", "/deployments", and "/deployments//vms".

Recommendations Update to version 282.1.9 or later.