Skip to content
OpenAdvisories

Vendor

BOSH-Ecosystem / BOSH (bosh-cli)

1 known vulnerabilities.

Products

bosh-cli 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-47828

    Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay

    During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the …

    BOSH-Ecosystem / BOSH (bosh-cli) bosh-cli