CVE-2019-11271: Cloud Foundry Bosh

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest.

Affected products

• Cloud Foundry Bosh: from 270.0.0, before 270.1.1 (fixed in 270.1.1)

Published 2019-06-19. Last modified 2026-06-17.