CVE-2026-41860EPSS p0.2%
CVE-2026-41860CVE-2026-41860
Description
CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials.
Affected versions:
- BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later
Scoring
| CVSS | 8.8 () |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 0.08% probability of exploitation · percentile 0.2% · 2026-06-18T12:00:27Z |
| Last modified | 2026-06-04 |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.