CVE-2026-41860: BOSH Information Disclosure Vulnerability

CVE-2026-41860 Overview

CVE-2026-41860 is a cryptographic weakness [CWE-326] affecting BOSH, the deployment and lifecycle management tool used by Cloud Foundry. The vulnerability resides in HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous, which hard-code OpenSSL::SSL::VERIFY_NONE. This disables TLS certificate verification on connections from bosh-monitor to the BOSH director and the User Account and Authentication (UAA) service. A local attacker positioned between these components can perform a man-in-the-middle (MITM) attack to intercept Basic-auth credentials or redirect UAA token requests.

Critical Impact
A local attacker with network access between BOSH components can intercept TLS traffic, steal Basic-auth credentials, and redirect UAA token requests, compromising the integrity of the entire BOSH-managed infrastructure.

Affected Products

BOSH: all versions prior to and including v282.1.9
Cloud Foundry deployments using vulnerable bosh-monitor components
Environments where bosh-monitor communicates with the BOSH director or UAA

Discovery Timeline

2026-06-04 - CVE-2026-41860 published to NVD
2026-06-04 - Last updated in NVD database

Technical Details for CVE-2026-41860

Vulnerability Analysis

The vulnerability stems from improper TLS certificate validation in the bosh-monitor component. Two methods in HttpRequestHelper, namely create_async_endpoint and send_http_get_request_synchronous, hard-code the OpenSSL constant VERIFY_NONE. This setting instructs the OpenSSL library to skip verification of the server certificate during TLS handshakes. As a result, bosh-monitor accepts any TLS certificate presented by a remote endpoint, including self-signed or attacker-controlled certificates.

bosh-monitor uses these methods to communicate with the BOSH director and the UAA. Both interactions transmit sensitive material, including Basic-auth credentials and UAA token requests used for authentication and authorization within the deployment.

Root Cause

The root cause is the explicit disabling of TLS peer verification within the HTTP client helper code. Hard-coding VERIFY_NONE removes the cryptographic guarantee that the server is the legitimate endpoint. This pattern qualifies as [CWE-326] Inadequate Encryption Strength, because the channel relies on TLS encryption without authenticating the peer.

Attack Vector

An attacker with local network access between bosh-monitor and either the BOSH director or UAA can present a forged TLS certificate. Because the client skips verification, the TLS session is established with the attacker-controlled proxy. The attacker then observes the Basic-auth header sent by bosh-monitor or intercepts UAA token requests. Captured credentials can be replayed against the BOSH director or UAA to authenticate as the monitor and pivot further into the environment.

No exploit code or proof-of-concept is publicly available. See the Cloud Foundry Blog Post for vendor-supplied technical details.

Detection Methods for CVE-2026-41860

Indicators of Compromise

Unexpected TLS certificates presented to bosh-monitor that do not match the BOSH director or UAA certificate fingerprints.
Anomalous network paths or unexpected intermediate hops between bosh-monitor and the director or UAA.
Authentication events at the BOSH director or UAA originating from IP addresses other than the legitimate bosh-monitor host.

Detection Strategies

Inspect bosh-monitor outbound TLS sessions and compare presented certificate fingerprints against known director and UAA certificates.
Audit running BOSH versions across the fleet and flag any instance at or below v282.1.9.
Review HTTP client code paths for occurrences of OpenSSL::SSL::VERIFY_NONE in custom BOSH plugins or forks.

Monitoring Recommendations

Enable network flow logging between bosh-monitor, the BOSH director, and UAA, and alert on unexpected destinations.
Forward BOSH director and UAA authentication logs to a centralized log platform for correlation against monitor activity.
Monitor for repeated authentication failures or credential reuse patterns consistent with replay attempts.

How to Mitigate CVE-2026-41860

Immediate Actions Required

Upgrade BOSH to v282.1.9 or later on all directors and bosh-monitor deployments.
Rotate any Basic-auth credentials and UAA client secrets used by bosh-monitor that may have transited a vulnerable path.
Restrict network reachability between bosh-monitor, the director, and UAA to trusted segments only.

Patch Information

The Cloud Foundry project has released BOSH v282.1.9, which removes the hard-coded VERIFY_NONE setting and enforces TLS certificate verification in HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous. Refer to the Cloud Foundry Blog Post for upgrade guidance and release notes.

Workarounds

Isolate bosh-monitor, the BOSH director, and UAA on a dedicated management network with strict access controls.
Apply host-based firewall rules to prevent untrusted processes from reaching monitor traffic.
Where upgrade is not immediately possible, treat all Basic-auth credentials used by bosh-monitor as potentially compromised and rotate on a defined schedule.

bash

# Verify the installed BOSH version meets the fixed release
bosh --version

# Upgrade the BOSH director using a release at or above v282.1.9
bosh deploy bosh-deployment.yml \
  -v bosh_version=282.1.9