The vulnerability allows an attacker performing a man‑in‑the‑middle between NATS Sync and the BOSH director to capture the director’s Basic authentication header or UAA client secret. It also enables tampering with the VM list that is written into the NATS authorization file. Stolen credentials provide full administrative access to the director. The weakness stems from an insecure SSL configuration (OpenSSL::SSL::VERIFY_NONE) in the Net::HTTP client, a classic example of CWE‑295.

Cloud Foundry Foundation BOSH – all releases prior to v282.1.9 (inclusive) are affected. The issue was fixed in v282.1.9 or later releases.

With a CVSS score of 7.1 the vulnerability is rated as high. Exploitation requires network proximity to intercept traffic between NATS Sync and the director, which is likely in clustered or shared environments. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploits in the wild as of this analysis. Nonetheless, the ability to obtain administrative credentials poses a significant risk to confidentiality, integrity, and availability for impacted deployments.