CVE-2026-41859: A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file

Synopsis

This is a credential-theft and data-tampering vulnerability in the BOSH nats-sync component, caused by disabled TLS certificate verification. The nats-sync process builds its HTTPS client with certificate verification turned off (VERIFY_NONE), meaning any attacker with a position between nats-sync and the BOSH director on the network can intercept traffic without detection. Successful exploitation lets an attacker steal BOSH director credentials (Basic auth header or UAA client secret) and tamper with the VM list written into the NATS authorization file, potentially gaining full administrative access to the director. A patched-image rebuild at version 282.1.9 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host, or a position on a network path between nats-sync and the BOSH director; no remote internet exposure is required.

• AuthenticationRequired

  A low-privilege account on the host or network segment is sufficient to position the attacker for interception.

• Victim interactionNot required

  No action from an operator or end user is needed; exploitation occurs passively during normal nats-sync-to-director API calls.

• Attack complexityDetail

  While the exploit itself is straightforward once positioned, the attacker requires a specific precondition: an adjacent network position or host access to intercept the unverified TLS connection (AT:P in the CVSS vector).

Blast Radius

• Reads the BOSH director Basic auth header or UAA client secret in plaintext from intercepted HTTP traffic, granting full administrative director access.
• Modifies the VM list returned to nats-sync, allowing the attacker to rewrite the NATS authorization file and control which VMs are permitted to communicate over NATS.
• Compromises downstream systems connected through NATS by injecting unauthorized VM entries into the authorization file.
• Causes persistent impact on systems dependent on BOSH director control (SC:H, SI:H, SA:H) by leveraging stolen credentials for ongoing unauthorized director operations.