BOSH EUVD-2026-34193

The attacker must hold an active network man-in-the-middle position on the path between the nats-sync process and the BOSH director's HTTPS API endpoints (/info, /deployments, /deployments/<name>/vms) - for example by controlling a router, a compromised management host, ARP/DNS poisoning, or an upstream proxy. Exploitation also requires that nats-sync actually initiates director calls (the normal authorization-sync workflow) while the attacker is on-path, so timing aligns with nats-sync's polling cadence. No special non-default configuration of BOSH is needed because the vulnerable VERIFY_NONE behavior is hardcoded in UsersSync#bosh_api_response_body for affected versions; limiting factors are purely the network position requirement (CVSS AT:P) and the need for nats-sync to be deployed and actively syncing.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H) scores 7.1 and reflects a local attack vector with low privileges plus a present attack requirement (the MitM position), but the subsequent scope impact is high across confidentiality, integrity, and availability because stolen director credentials grant full administrative control of the deployment plane. EPSS, KEV, and SSVC signals were not supplied in the input, and no public exploit identified at time of analysis. The practical risk is meaningful for any operator whose nats-sync-to-director path traverses untrusted segments, since the missing certificate check turns a passive network foothold into a direct path to administrative takeover; the AT:P requirement (an attacker must already be on-path) is the main factor keeping this below a critical rating. One caveat worth flagging: the CVSS AV:L classification appears conservative given the description explicitly describes a network MitM, so operators should not dismiss this as purely local.

An attacker who has gained a foothold on a network segment carrying nats-sync-to-director traffic (for example a compromised jumpbox, a rogue device in the management VLAN, or via ARP/BGP/DNS redirection) presents a self-signed TLS certificate for the director's hostname. Because nats-sync uses VERIFY_NONE, the TLS handshake completes and the attacker captures the Basic auth header or UAA client secret on the next /info or /deployments request, then returns a tampered /deployments/<name>/vms response so the NATS authorization file is rewritten to the attacker's advantage. The captured credentials are then replayed directly against the BOSH director for full administrative control. No public proof-of-concept is referenced in the available data.