Security Advisory

CVE-2026-41012- BOSH VSphere CPI Improper Cert Validation

Security Advisory

CVE-2026-41012- BOSH VSphere CPI Improper Cert Validation

by Cloud Foundry Foundation Security Team August 27, 2026

CVE-2026-59335 – UAA case insensitive check bypass

Security Advisory

CVE-2026-59335 – UAA case insensitive check bypass

by Cloud Foundry Foundation Security Team August 24, 2026

CVE-2026-47827 – BOSH CLI Powershell Injection

Security Advisory

CVE-2026-47827 – BOSH CLI Powershell Injection

by Cloud Foundry Foundation Security Team August 20, 2026

CVE-2026-41861 – Arbitrary Root File Write via Path Traversal in BOSH agent

Security Advisory

CVE-2026-41861 – Arbitrary Root File Write via Path Traversal in BOSH agent

by Cloud Foundry Foundation Security Team August 6, 2026

CVE-2026-47840 – LDAP StartTLS unconditionally disables hostname verification

Security Advisory

CVE-2026-47840 – LDAP StartTLS unconditionally disables hostname verification

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47830 – Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite

Security Advisory

CVE-2026-47830 – Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47831 – Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks

Security Advisory

CVE-2026-47831 – Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47829 – Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director

Security Advisory

CVE-2026-47829 – Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47828 – Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay

Security Advisory

CVE-2026-47828 – Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47826 – blobs.yaml Path Traversal Allows File Writes

Security Advisory

CVE-2026-47826 – blobs.yaml Path Traversal Allows File Writes

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-41857 – BOSH CLI Shell Injection

Security Advisory

CVE-2026-41857 – BOSH CLI Shell Injection

by Cloud Foundry Foundation Security Team July 8, 2026

CVE-2026-47833 – Symlink vulnerability in setupBpmLogs allows container-to-host privilege escalation via /etc/shadow

Security Advisory

CVE-2026-47833 – Symlink vulnerability in setupBpmLogs allows container-to-host privilege escalation via /etc/shadow

by Cloud Foundry Foundation Security Team June 18, 2026