CWE-326 in BOSH

CVE-2026-41860 is a TLS verification failure in BOSH bosh-monitor where HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE. Per the vendor advisory and NVD, every BOSH release before v282.1.9 is affected. The practical result is that an attacker who can position themselves for a man-in-the-middle between bosh-monitor and the Director or UAA can intercept Basic-auth credentials or redirect token requests.

The vendor's HIGH label is too generous for enterprise patch triage because the exploit chain starts with *local or management-network foothold*, not unauthenticated internet reachability. The impact after compromise is serious because stolen Director or UAA credentials can hand an attacker the keys to the BOSH management plane, but the decisive reality is the attacker must already be on or adjacent to a tightly scoped internal control path that many shops never expose publicly.

Why this verdict

• Start from vendor HIGH, then cut for attacker position: AV:L is not a paper detail here; it means the attacker already has code execution or a very favorable management-network foothold.
• Cut again for implied prior compromise: a requirement to MITM bosh-monitor toward Director/UAA is not initial access, it's lateral movement or insider positioning on the control plane.
• Cut again for exposed population: BOSH Directors and their UAA/control links are typically private, administratively fenced, and often colocated, so the reachable set is much smaller than generic enterprise software.
• Do not cut to LOW: if the attacker does win this position, stolen Director or UAA credentials can translate into serious control-plane impact across many managed VMs and deployments.

Why not higher?

This is not an unauthenticated internet RCE, not a one-packet bug, and not a broadly exposed service issue. The exploit chain assumes a prior foothold plus a workable MITM position on a management path that many environments keep private and tightly segmented.

Why not lower?

The downstream blast radius is too large for LOW once valid Director or UAA credentials are captured. BOSH sits in the orchestration layer, so a successful interception can become estate-wide operational compromise, not just a single-host nuisance.

1. Isolate the BOSH management plane — Restrict Director, UAA, and health-monitor traffic to dedicated management networks and bastions only. For a MEDIUM verdict there is no mitigation SLA, but this is the most effective structural control to apply during normal hardening because it directly removes the attacker positioning assumption.
2. Tighten Director host access — Review who can SSH to Director-adjacent systems, remove stale admin paths, and enforce short-lived access via bastions. There is no mitigation SLA for MEDIUM, but reducing local shell access materially cuts the realistic exploit population.
3. Watch for MITM indicators on management segments — Alert on ARP spoofing, rogue proxies, unexpected TLS issuers, and unusual listeners on Director/UAA-related ports. There is no mitigation SLA for MEDIUM, but this provides the best chance to catch the preconditions before credential theft.
4. Audit BOSH and UAA auth activity — Review Director task creation, new CLI targets, token issuance anomalies, and admin API use from unusual source IPs. Again, no mitigation SLA for MEDIUM; treat this as a targeted detection uplift while patching is scheduled.

Run this on the BOSH Director VM itself as root or via sudo, because it reads /var/vcap/jobs and may grep package contents. Example: sudo bash ./check-cve-2026-41860.sh. It first tries to read the deployed BOSH release version from the rendered job spec; if that is unavailable, it falls back to code inspection for the vulnerable VERIFY_NONE pattern.

#!/usr/bin/env bash
# check-cve-2026-41860.sh
# Detects likely exposure to CVE-2026-41860 on a BOSH Director VM.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_VERSION="282.1.9"
SPEC_CANDIDATES=(
  "/var/vcap/jobs/health_monitor/spec"
  "/var/vcap/jobs/director/spec"
)
SEARCH_DIRS=(
  "/var/vcap/packages"
  "/var/vcap/jobs"
)

version_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

extract_version_from_spec() {
  local spec="$1"
  local v=""

  [ -r "$spec" ] || return 1

  # Try YAML-ish forms first: release:\n  version: X or release.version: X
  v=$(awk '
    BEGIN{in_release=0}
    /^[[:space:]]*release:[[:space:]]*$/ {in_release=1; next}
    in_release && /^[[:space:]]*version:[[:space:]]*/ {
      sub(/^[[:space:]]*version:[[:space:]]*/, "", $0)
      gsub(/"/, "", $0)
      print $0
      exit
    }
    /^[^[:space:]]/ && $0 !~ /^release:[[:space:]]*$/ {in_release=0}
    /^[[:space:]]*release\.version:[[:space:]]*/ {
      sub(/^[[:space:]]*release\.version:[[:space:]]*/, "", $0)
      gsub(/"/, "", $0)
      print $0
      exit
    }
  ' "$spec")

  if [ -n "$v" ]; then
    printf '%s' "$v"
    return 0
  fi

  # Try JSON-ish single-line patterns if present
  v=$(grep -Eo '"version"[[:space:]]*:[[:space:]]*"[0-9][0-9A-Za-z._-]*"' "$spec" 2>/dev/null | head -n1 | sed -E 's/.*"([0-9][0-9A-Za-z._-]*)"/\1/')
  if [ -n "$v" ]; then
    printf '%s' "$v"
    return 0
  fi

  return 1
}

for spec in "${SPEC_CANDIDATES[@]}"; do
  if v=$(extract_version_from_spec "$spec"); then
    if version_lt "$v" "$TARGET_VERSION"; then
      echo "VULNERABLE: BOSH release version $v is older than $TARGET_VERSION"
      exit 1
    else
      echo "PATCHED: BOSH release version $v is $TARGET_VERSION or newer"
      exit 0
    fi
  fi
done

# Fallback: inspect deployed code for the vulnerable pattern.
# This is heuristic, so we only declare VULNERABLE if we find both the helper names
# and VERIFY_NONE in plausible BOSH package/job content.
if grep -R -E -n 'HttpRequestHelper|create_async_endpoint|send_http_get_request_synchronous|OpenSSL::SSL::VERIFY_NONE' "${SEARCH_DIRS[@]}" 2>/dev/null | grep -q 'VERIFY_NONE'; then
  echo "VULNERABLE: found deployed BOSH code referencing OpenSSL::SSL::VERIFY_NONE in relevant paths"
  exit 1
fi

echo "UNKNOWN: could not determine deployed BOSH release version and no decisive code pattern was found"
exit 2

Sources

1. NVD entry for CVE-2026-41860
2. Cloud Foundry security advisory
3. BOSH components documentation
4. BOSH monitoring documentation
5. BOSH Director with UAA documentation
6. BOSH CLI global flags documentation
7. cloudfoundry/bosh releases
8. CISA Known Exploited Vulnerabilities Catalog