CVE-2026-47831 Overview
CVE-2026-47831 is a cryptographic weakness in the GenerateRandomPassword function of bosh-windows-stemcell-builder. The function relies on a non-cryptographic pseudo-random number generator, producing SSH passwords with insufficient entropy. A remote attacker on an adjacent network can brute-force the resulting SSH login over TCP/22 and gain access to Windows stemcell instances built with vulnerable versions. All bosh-windows-stemcell-builder releases prior to v2019.98 are affected. The issue falls under insecure random number generation and enables authenticated compromise of Windows workloads deployed through Cloud Foundry BOSH.
Critical Impact
Attackers within adjacent network range can guess SSH credentials generated by the vulnerable function and obtain administrative access to Windows stemcell instances.
Affected Products
- bosh-windows-stemcell-builder versions prior to v2019.98
- Cloud Foundry BOSH deployments using vulnerable Windows stemcells
- Windows-based BOSH-managed workloads provisioned with affected builder versions
Discovery Timeline
- 2026-07-09 - CVE CVE-2026-47831 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-47831
Vulnerability Analysis
The bosh-windows-stemcell-builder project provisions Windows virtual machine images for BOSH-managed deployments. During image creation, the builder generates an administrative password used for SSH access on TCP/22. The GenerateRandomPassword function produces this credential using a cryptographically weak random number generator rather than a secure source such as crypto/rand. Weak generators produce predictable output sequences when the seed space is small or algorithmically inferable. An attacker can reproduce the generator state or enumerate the reduced keyspace to brute-force valid credentials. Because the same generation logic runs for every stemcell built by an affected version, deployments share a predictable password structure across environments.
Root Cause
The root cause is insecure random number generation in credential material. Non-cryptographic PRNGs, such as those seeded from time-based values, produce output that is statistically random but not unpredictable to an attacker. When used for authentication secrets, this collapses the effective keyspace far below what the password length suggests. This weakness maps to CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator).
Attack Vector
Exploitation requires network adjacency to a target running a vulnerable Windows stemcell with SSH exposed on TCP/22. The attacker connects to the SSH service and attempts credentials derived from the reduced keyspace of the weak generator. No prior authentication or user interaction is required. Successful brute-force yields interactive SSH access with the privileges assigned to the stemcell administrative account. The vulnerability manifests during password generation at build time; runtime detection at the stemcell level is not possible without inspecting the generator implementation. See the Cloud Foundry Blog Analysis for additional technical detail.
Detection Methods for CVE-2026-47831
Indicators of Compromise
- Repeated SSH authentication failures on TCP/22 targeting Windows BOSH instances, followed by a successful login.
- Successful SSH sessions from adjacent-network sources not previously seen accessing stemcell hosts.
- New administrative sessions or process launches under the stemcell's built-in admin account outside deployment workflows.
Detection Strategies
- Inventory bosh-windows-stemcell-builder versions used across build pipelines and flag any prior to v2019.98.
- Correlate SSH login events on Windows stemcells against expected BOSH orchestration source addresses.
- Alert on high-rate authentication attempts against TCP/22 on stemcell subnets.
Monitoring Recommendations
- Forward Windows SSH server and Security event logs to a central SIEM for authentication analytics.
- Track outbound connections from stemcell instances to detect post-exploitation lateral movement.
- Monitor BOSH director logs for stemcell rebuilds and password rotation events.
How to Mitigate CVE-2026-47831
Immediate Actions Required
- Upgrade bosh-windows-stemcell-builder to v2019.98 or later and rebuild all Windows stemcells.
- Rotate SSH credentials on every Windows instance provisioned by affected builder versions.
- Restrict TCP/22 access to Windows stemcell instances using network security groups or host firewalls.
- Disable SSH on stemcell instances where remote administration is not required.
Patch Information
The fix is available in bosh-windows-stemcell-builderv2019.98. The updated release replaces the weak generator in GenerateRandomPassword with a cryptographically secure source. Refer to the Cloud Foundry Blog Analysis for release notes and upgrade guidance.
Workarounds
- Manually override the generated password with a high-entropy value from a cryptographically secure source before deployment.
- Enforce SSH key-based authentication and disable password authentication on Windows stemcells.
- Segment stemcell networks to eliminate adjacent-network reachability from untrusted hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
