CVE-2026-47828: Cloudfoundry Bosh CLI

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.

Affected products

• Cloudfoundry Bosh CLI: before 7.10.4 (fixed in 7.10.4)

Published 2026-07-09. Last modified 2026-07-13.