Bosh Cli CVE-2026-47828

The BOSH CLI (bosh-cli) contains a certificate verification bypass that allows adjacent network attackers to intercept deployment credentials and administrative secrets during infrastructure provisioning. An attacker exploiting this vulnerability can gain root access to newly deployed BOSH Directors, potentially compromising the security and availability of mission-critical cloud infrastructure environments.

Within 24 hours: Inventory all systems running bosh-cli prior to v7.10.4; immediately restrict deployment network access to isolated, trusted network segments only. Within 7 days: Rotate all credentials and re-encrypt deployment manifests for any BOSH Directors provisioned since vulnerability disclosure; implement continuous packet inspection on deployment traffic. Within 30 days: Subscribe to BOSH security advisories; apply vendor-released patch to bosh-cli v7.10.4 or later immediately upon release; re-validate and re-credential all Director instances post-patch.

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict BOSH CLI deployments to physically or logically isolated networks separated from untrusted segments; (2) Require cryptographic authentication and VPN access for all deployment network operations; (3) Implement real-time network monitoring and packet capture on all infrastructure deployment traffic; (4) Mandate post-deployment credential rotation and re-encryption of all provisioning manifests.