BOSH vSphere CPI CVE-2026-41012

The attacker must be positioned on the network path between the BOSH Director host and the vCenter server - achievable through ARP spoofing, a compromised network device, rogue routing advertisement, or unauthorized physical or virtual access to the management VLAN. No authentication to BOSH Director or vCenter is required on the attacker's side (PR:N per CVSS). Exploitation windows are frequent and automatic: credentials are transmitted on every CPI call including routine deployments and health checks, not only during tag operations or special administrator-triggered events. The primary limiting factor is achieving that network-adjacent position; environments where BOSH Director and vCenter communicate exclusively over a strictly isolated management network segment with no access from workload VMs or shared jump hosts have a substantially reduced attack surface. Supplying a CA certificate to the CPI does not limit exploitation because the certificate validation code path is not properly enforced.

The CVSS 7.7 score with Scope:Changed reflects the disproportionate downstream impact - a single interception escalates to full vCenter administrative control affecting potentially thousands of VMs. However, the official AV:L (Local) metric is in direct conflict with the description, which clearly describes a network-level man-in-the-middle attack; this discrepancy is significant and should be verified with Cloud Foundry, as the realistic attack surface appears to be network-adjacent (AV:A) rather than strictly local. AC:H correctly captures the prerequisite of achieving a privileged position on the BOSH Director-vCenter communication path. No EPSS data was provided in the input, and the CVE is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code has been identified. Despite the absence of confirmed exploitation, the potential consequence - full vCenter administrative access - is severe enough that any operator running BOSH-managed vSphere deployments should prioritize remediation, especially in environments where the management plane network is not strictly isolated from workload or jump-host networks.

An attacker who has compromised a host on the management VLAN, or who can perform ARP spoofing or BGP hijacking on the path between BOSH Director and vCenter, presents a self-signed TLS certificate to intercept the CPI's HTTPS connection. Because the CPI does not validate the certificate chain, the handshake succeeds and the attacker receives the HTTP Basic Authorization header - containing the base64-encoded vCenter administrator password - on the very next routine CPI call, such as a scheduled deployment or health-check operation. No special administrator action is required; credentials are transmitted automatically during normal BOSH lifecycle operations, giving the attacker frequent and predictable exploitation windows.