Answer in brief
CVE-2026-47828 records a High severity (CVSS 8.9) vulnerability in Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay. The current sources do not mark it as known exploited. The current feed maps BOSH-Ecosystem / BOSH (bosh-cli)/bosh-cli (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps BOSH-Ecosystem / BOSH (bosh-cli)/bosh-cli (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| BOSH-Ecosystem / BOSH (bosh-cli)/bosh-cligeneric | >=0 <7.10.4 | 7.10.4 |
Published upstream
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 9, 2026
During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-47828 records a High severity (CVSS 8.9) vulnerability in Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay. The current sources do not mark it as known exploited. The current feed maps BOSH-Ecosystem / BOSH (bosh-cli)/bosh-cli (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps BOSH-Ecosystem / BOSH (bosh-cli)/bosh-cli (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| BOSH-Ecosystem / BOSH (bosh-cli)/bosh-cligeneric | >=0 <7.10.4 | 7.10.4 |
Published upstream
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 9, 2026
During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.
Quoted source text, attributed separately from HOL analysis.