CVE-2026-47828

highCVSS 7.1covered by 1 sourcefirst seen 2026-07-09

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.

⚡ Watch CVE-2026-47828

Get an email if CVE-2026-47828 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.09% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 0% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-47828: During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered…nvd · 2026-07-09

External references

NVD record for CVE-2026-47828

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-47828 status](https://www.csirts.com/badge/CVE-2026-47828)](https://www.csirts.com/cve/CVE-2026-47828)