Which versions of Bosh Cli are affected by CVE-2026-47828?

The BOSH CLI (bosh-cli) contains a certificate verification bypass that allows adjacent network attackers to intercept deployment credentials and administrative secrets during infrastructure…. A patch is available.

How to fix or mitigate CVE-2026-47828?

Within 24 hours: Inventory all systems running bosh-cli prior to v7.10.4; immediately restrict deployment network access to isolated, trusted network segments only. Within 7 days: Rotate all credentials and re-encrypt deployment manifests for any BOSH Directors provisioned since vulnerability disclosure; implement continuous packet inspection on deployment traffic. Within 30 days: Subscribe to BOSH security advisories; apply vendor-released patch to bosh-cli v7.10.4 or later immediately upon release; re-validate and re-credential all Director instances post-patch.

Bosh Cli CVE-2026-47828

Q: What is the CVSS score of CVE-2026-47828?

CVE-2026-47828 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42514 HIGH

2026-07-09 vmware

GHSA-93mr-7m4p-h3cq

RCE Bosh Cli

8.9

CVSS 4.0 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.9 HIGH

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 08:01 EUVD

Analysis Generated

Jul 09, 2026 - 07:17 vuln.today

DescriptionCVE.org

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.

AnalysisAI

Man-in-the-middle credential theft and root code execution affects the BOSH CLI (bosh-cli) prior to v7.10.4, which fails to verify the DAV blobstore server certificate during 'bosh create-env' and 'bosh delete-env' even though a valid CA certificate is present in the installation manifest. An adjacent network attacker who can intercept the operator's HTTPS upload can harvest Basic-auth credentials and the rendered-templates archive holding every bootstrap secret for the new BOSH Director, then replay those credentials against the target VM's agent to gain root code execution. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Inventory all systems running bosh-cli prior to v7.10.4; immediately restrict deployment network access to isolated, trusted network segments only. …

Threat intelligence, references, and detailed analysis are available after sign-in.