CVE-2026-41860CWE-326

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM

High · published June 4, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
1.0
In the wild
Unconfirmed
What it is

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials.

Affected versions:

- BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H
EPSS
0.00104 · 1.0th percentile
Weakness
CWE-326 · Inadequate Encryption Strength
Published
2026-06-04T01:40Z
EPSS history
Timeline
  • 04 JUN 01:40Z
    CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM
    cvelistv5