CVE-2026-47828: BOSH CLI RCE Vulnerability

CVE-2026-47828 Overview

CVE-2026-47828 is a missing TLS certificate verification vulnerability in the BOSH CLI. During bosh create-env and bosh delete-env operations, the CLI uploads compiled Cloud Provider Interface (CPI) packages and rendered job templates to the new virtual machine's DAV blobstore over HTTPS. The client does not validate the server certificate, even though the installation manifest supplies a CA certificate for that endpoint. An adjacent-network attacker can terminate the TLS session, harvest Basic-auth credentials, read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, and replay those credentials against the real VM's agent for root code execution. Affected versions include bosh-cli releases prior to v7.10.4.

Critical Impact
A man-in-the-middle attacker on an adjacent network can steal BOSH Director bootstrap secrets and gain root code execution on newly provisioned VMs.

Affected Products

BOSH CLI (bosh-cli) versions prior to v7.10.4
Cloud Foundry environments deployed with vulnerable bosh-cli
BOSH Director bootstrap workflows using create-env and delete-env

Discovery Timeline

2026-07-09 - CVE-2026-47828 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-47828

Vulnerability Analysis

The BOSH CLI uses a DAV (WebDAV) blobstore on the target VM to stage bootstrap artifacts during environment creation and teardown. The upload channel operates over HTTPS with HTTP Basic authentication. The client bypasses certificate validation, so any certificate presented by an intermediary is accepted.

The installation manifest already contains the CA certificate for the blobstore endpoint. The CLI fails to pass this trust anchor into the HTTPS client used for DAV uploads. The result is an unauthenticated trust boundary between the operator's workstation and the freshly provisioned VM.

The rendered-templates archive uploaded through this channel contains every secret required to bootstrap a new BOSH Director. Exposure of these secrets undermines the confidentiality and integrity of the entire deployment.

Root Cause

The defect is an improper certificate validation flaw [CWE-295]. The HTTPS client used for DAV uploads is instantiated without the CA bundle referenced in the installation manifest. TLS handshakes complete against any certificate, including attacker-controlled ones, without producing an error.

Attack Vector

An attacker positioned on the adjacent network path between the operator running bosh-cli and the target VM intercepts the DAV upload. The attacker terminates the TLS session with a self-signed certificate, captures the Basic-auth header, and receives the rendered-templates archive. Using the harvested credentials, the attacker connects to the legitimate BOSH agent on the target VM and executes commands as root. The Cloud Foundry advisory for CVE-2026-47828 provides additional context on the credential replay chain.

Detection Methods for CVE-2026-47828

Indicators of Compromise

Unexpected TLS certificates presented by DAV blobstore endpoints on newly provisioned BOSH VMs.
Repeated bosh create-env or bosh delete-env sessions originating from unusual source hosts or network paths.
BOSH agent authentication events on new VMs from IP addresses that are not the operator workstation.
Anomalous shell or process activity as root on a VM shortly after initial provisioning.

Detection Strategies

Inspect network telemetry between operator workstations and BOSH-managed VMs for TLS sessions terminating at unexpected certificate fingerprints.
Correlate bosh-cli invocations with subsequent BOSH agent command execution events to identify replay of harvested credentials.
Alert on outbound HTTPS uploads from operator hosts that ignore the CA bundle referenced in the installation manifest.

Monitoring Recommendations

Log and retain full command-line and process telemetry from operator workstations that run bosh-cli.
Capture and review BOSH agent authentication logs on newly created VMs for source-address anomalies.
Monitor DAV blobstore endpoints for connections from hosts other than the intended CLI operator.

How to Mitigate CVE-2026-47828

Immediate Actions Required

Upgrade bosh-cli to v7.10.4 or later on every workstation and automation host used for BOSH deployments.
Rotate any BOSH Director bootstrap secrets, DAV blobstore credentials, and agent credentials that may have transited a vulnerable CLI.
Restrict bosh create-env and bosh delete-env operations to trusted networks pending patch deployment.
Audit recent Director bootstrap events for evidence of credential replay or unexpected root activity.

Patch Information

Cloud Foundry addressed CVE-2026-47828 in bosh-cli version v7.10.4. The patched release enforces TLS certificate verification for DAV blobstore uploads using the CA certificate supplied in the installation manifest. Refer to the Cloud Foundry advisory for release notes and upgrade guidance.

Workarounds

Run bosh create-env and bosh delete-env only from an isolated management network that eliminates adjacent-network interception.
Enforce out-of-band verification of the DAV blobstore certificate fingerprint before each bootstrap operation.
Rebuild any Director provisioned with a vulnerable CLI once patched tooling is in place and credentials have been rotated.

bash

# Upgrade bosh-cli to the patched release
bosh --version
# Download and install bosh-cli v7.10.4 or later from the official release channel
# then confirm the version before running create-env or delete-env
bosh --version | grep -E 'v7\.10\.(4|[5-9]|[1-9][0-9]+)'