Bosh

This hub aggregates every CVE we track for Bosh, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 9 most recently published vulnerabilities affecting Bosh.

• CVE-2026-41861Arbitrary Root File Write via Path Traversal in BOSH agent4.2Aug 6, 2026
• CVE-2026-41011PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the up...8.2Jun 4, 2026
• CVE-2026-41859A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into ...7.8Jun 4, 2026
• CVE-2026-41860CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-...8.8Jun 4, 2026
• CVE-2026-41704Compromised VM can make arbitrary blobstore deletes5.0May 27, 2026
• CVE-2026-41009Local Blobstore may allow arbitrary reads/deletes5.8May 27, 2026
• CVE-2019-11271Bosh Deployment logs leak sensitive information7.8Jun 18, 2019
• CVE-2018-11083Bosh accepts refresh tokens in place of an access token8.1Oct 5, 2018
• CVE-2017-4961An issue was discovered in Cloud Foundry Foundation BOSH Release 261.x versions prior to 261.3 and all 260.x versions. In certain cases an authenticated Director user can provide a malicious checks...8.8Jun 13, 2017