The affected component is BOSH’s HttpRequestHelper, which hard‑codes the SSL verification mode to VERIFY_NONE. Because of this, a user who has local access to a system running bosh‑monitor can perform a man‑in‑the‑middle between the monitor and the BOSH director or the UAA service, capturing Basic‑Auth credentials or redirecting OAuth token requests. The consequence is the compromise of authentication tokens or credentials used by other services, leading to lateral movement or full system takeover.

Cloud Foundry Foundation’s BOSH platform is impacted. All releases prior to version 282.1.9, inclusive, contain the hard‑coded verify flag. This includes the bosh‑monitor component that issues HTTP requests to the BOSH director and to the UAA service.

The CVSS score of 7.1 reflects a moderate‑to‑high severity. The EPSS score is not provided, but the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed public exploitation yet. Nonetheless, a local attacker with access to the bosh‑monitor host can launch the attack by simply accessing the HTTP endpoints without additional network reachability. The exploit path is straightforward: first exploit local access, then intercept the TLS connections, and subsequently capture credentials or reroute OAuth traffic. Prevention requires securing the TLS validation and restricting local access.