CVE-2026-41860: CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM

Synopsis

An inadequate cryptographic strength vulnerability (CWE-326) in BOSH, the Cloud Foundry infrastructure orchestrator, allows a local attacker to intercept TLS-protected traffic between bosh-monitor and the BOSH director or UAA. The affected code in HttpRequestHelper hard-codes OpenSSL::SSL::VERIFY_NONE, meaning TLS certificates are never verified and any process or user on the same host can perform a man-in-the-middle attack to steal Basic-auth credentials or hijack UAA token requests. Successful exploitation gives the attacker long-lived credentials and the ability to impersonate both the monitor and the target services. A patched-image rebuild at v282.1.9 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the service is required.

• AuthenticationRequired

  A low-privilege local account is sufficient; no administrative access is needed to position a man-in-the-middle process on the host.

• Victim interactionNot required

  No victim action is required; the attacker passively intercepts traffic initiated by bosh-monitor.

• Attack complexityDetail

  Attack timing is constrained by an attack requirement (AT:P), meaning specific conditions such as a race or environmental prerequisite must align, though no exploit complexity beyond positioning is needed once they do.

Blast Radius

• Attacker reads plaintext Basic-auth credentials transmitted between bosh-monitor and the BOSH director, enabling direct reuse of those credentials against the director API.
• Attacker intercepts and redirects UAA token requests, allowing impersonation of bosh-monitor and acquisition of OAuth tokens scoped to infrastructure management.
• With stolen credentials or tokens, the attacker gains high-integrity write access to the BOSH director and any systems it manages (SI:H), permitting deployment manipulation or service reconfiguration.
• Downstream systems that depend on UAA-issued tokens or BOSH director API access inherit the same exposure, extending the blast radius to the broader Cloud Foundry control plane (SC:H, SA:H).