CVE-2026-47828

Name of the Vulnerable Software and Affected Versions bosh-cli versions prior to 7.10.4

Description During the execution of bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore via HTTPS. The process fails to verify the server certificate despite a CA certificate being available in the installation manifest. A network attacker can intercept the TLS connection to harvest Basic-auth credentials and access the rendered-templates archive, which contains bootstrap secrets for the new BOSH Director. These credentials can then be replayed against the VM's agent to achieve root code execution.

Recommendations Update bosh-cli to version 7.10.4 or later.