The BOSH CLI, when performing create‑env or delete‑env, uploads compiled CPI packages and rendered job templates to a VM’s DAV blobstore over HTTPS without validating the server’s certificate, even though a CA certificate is supplied in the installation manifest. A network attacker can terminate the TLS session, harvest Basic‑auth credentials, read the archive containing all bootstrap secrets for a new BOSH Director, and replay those credentials against the VM’s agent. This enables the attacker to execute arbitrary code with root privileges, compromising confidentiality, integrity, and availability of the director.

The BOSH‑Ecosystem BOSH CLI (bosh-cli) versions prior to 7.10.4 are affected.

The CVSS score of 8.9 reflects high severity, but the EPSS score of <1% indicates a low likelihood of current exploitation. The issue is not listed in CISA KEV. Exploitation requires a man‑in‑the‑middle on the HTTPS connection used during create‑env or delete‑env to capture Basic‑auth credentials, which can then be replayed to gain full root control of the BOSH Director. Because the flaw is a missing certificate verification (CWE‑295) with a well‑defined attack path, the risk remains significant when vulnerable CLI versions are in use.