EUVD-2026-42514
GHSA-93mr-7m4p-h3cq
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Man-in-the-middle credential theft and root code execution affects the BOSH CLI (bosh-cli) prior to v7.10.4, which fails to verify the DAV blobstore server certificate during 'bosh create-env' and 'bosh delete-env' even though a valid CA certificate is present in the installation manifest. An adjacent network attacker who can intercept the operator's HTTPS upload can harvest Basic-auth credentials and the rendered-templates archive holding every bootstrap secret for the new BOSH Director, then replay those credentials against the target VM's agent to gain root code execution. There is no public exploit identified at time of analysis, but the vendor-rated CVSS 4.0 score of 8.9 reflects the high impact of a full Director compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Bosh Cli gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
1DescriptionCVE.org
During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.
Executive ViewAI
The BOSH CLI (bosh-cli) contains a certificate verification bypass that allows adjacent network attackers to intercept deployment credentials and administrative secrets during infrastructure provisioning. An attacker exploiting this vulnerability can gain root access to newly deployed BOSH Directors, potentially compromising the security and availability of mission-critical cloud infrastructure environments.
Within 24 hours: Inventory all systems running bosh-cli prior to v7.10.4; immediately restrict deployment network access to isolated, trusted network segments only. Within 7 days: Rotate all credentials and re-encrypt deployment manifests for any BOSH Directors provisioned since vulnerability disclosure; implement continuous packet inspection on deployment traffic. Within 30 days: Subscribe to BOSH security advisories; apply vendor-released patch to bosh-cli v7.10.4 or later immediately upon release; re-validate and re-credential all Director instances post-patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict BOSH CLI deployments to physically or logically isolated networks separated from untrusted segments; (2) Require cryptographic authentication and VPN access for all deployment network operations; (3) Implement real-time network monitoring and packet capture on all infrastructure deployment traffic; (4) Mandate post-deployment credential rotation and re-encryption of all provisioning manifests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Cloud Foundry BOSH CLI, versions prior to v3.0.1, contains an improper access control vulnerability. Rated high severity
Command injection in Cloud Foundry's BOSH CLI on Windows enables an adjacent-network attacker to execute arbitrary shell
Argument injection in bosh-cli versions before v7.10.4 lets a compromised or malicious BOSH Director inject arbitrary Op
Arbitrary command execution on operator workstations in Cloud Foundry BOSH CLI before 7.10.5 allows a compromised or mal
Vendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE CaaS Platform 4.0 | Affected |
| SUSE Enterprise Storage 7.1 | Affected |
| SUSE Linux Enterprise Server 15 SP1-BCL | Affected |
| SUSE Linux Enterprise Server 15 SP1-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP2-BCL | Affected |
| SUSE Linux Enterprise Server 15 SP2-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP3-BCL | Affected |
| SUSE Linux Enterprise Server 15 SP3-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| SUSE Linux Enterprise Module for CAP 15 | Affected |
| SUSE Linux Enterprise Module for CAP 15 SP1 | Affected |
| SUSE Linux Enterprise Module for CAP 15 SP2 | Affected |
| SUSE Linux Enterprise Module for CAP 15 SP3 | Affected |
Exploit-DB