BOSH CVE-2026-41860

Exploitation requires the attacker to occupy a man-in-the-middle position on the network path between bosh-monitor and either the BOSH director or the UAA service - concretely, the ability to intercept or redirect traffic on the BOSH management network (ARP spoofing on the same L2 segment, control of an intermediate router/DNS, or compromise of an adjacent VM). The CVSS 4.0 vector additionally indicates the attacker must hold some low-level privilege (PR:L) on a local/adjacent system and that an Attack Requirement (AT:P) applies, meaning the traffic of interest must actually be flowing at the time of interception. Limiting factors: the issue is not internet-reachable, bosh-monitor must be enabled and actively polling the director/UAA, the deployment must be running a vulnerable BOSH version prior to v282.1.9, and the attacker needs network-adjacent positioning rather than just a remote unauthenticated path.

The CVSS 4.0 score of 7.1 reflects a meaningful but constrained risk: the attack vector is Local (AV:L), complexity is Low (AC:L) but an Attack Requirement is present (AT:P), and the attacker must hold Low privileges (PR:L), with no user interaction needed. Confidentiality impact to the vulnerable system is High (VC:H) and the subsequent system - the director/UAA whose credentials get stolen - sees High impact across confidentiality, integrity and availability (SC:H/SI:H/SA:H), which is the dominant driver of the score. There is no EPSS score, no CISA KEV entry, and no public POC identified, so this is not an opportunistic mass-exploitation candidate; it is a targeted, position-dependent flaw that becomes severe once an adversary already has a foothold in the deployment network. Note the apparent tension between AV:L and the description's MITM framing: AV:L here reflects that the attacker must already be adjacent on the bosh-monitor traffic path (i.e. an internal/local network position) rather than reachable from the public internet - defenders should interpret it as 'attacker on the management network' rather than 'attacker with a shell'.

An attacker who has compromised a workload VM or a network device on the BOSH management subnet performs ARP or DNS spoofing to redirect bosh-monitor's HTTPS traffic through their host, presents a self-signed certificate that the patched-out VERIFY_NONE client accepts without complaint, and harvests the Basic-auth header sent to the BOSH director plus the OAuth token request sent to UAA. With those director credentials and UAA tokens the attacker can then issue deployment changes, exfiltrate manifests and credentials, or pivot into managed Cloud Foundry tenants. No public POC has been identified, but the bug is mechanically simple to weaponize with off-the-shelf tools such as mitmproxy or bettercap.