CVE-2026-41859

🗓️ 04 Jun 2026 01:51:45Reported by vmwareType

cve🔗 web.nvd.nist.gov👁 18 Views🌐 WEB

Network attacker between nats sync and the BOSH director can steal credentials and tamper VM lists; fixed in version 282.1.9 or later.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-41859	4 Jun 202601:51	–	attackerkb
Cloud Foundry	CVE-2026-41859 - Missing TLS in NATS sync \| Cloud Foundry	1 Jun 202600:00	–	cloudfoundry
Circl	CVE-2026-41859	4 Jun 202605:01	–	circl
CNNVD	Cloud Foundry BOSH 安全漏洞	4 Jun 202600:00	–	cnnvd
Cvelist	CVE-2026-41859	4 Jun 202601:51	–	cvelist
EUVD	EUVD-2026-34193	4 Jun 202601:51	–	euvd
NVD	CVE-2026-41859	4 Jun 202603:16	–	nvd
Positive Technologies	PT-2026-46133	4 Jun 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-41859	5 Jun 202619:20	–	redhatcve
Vulnrichment	CVE-2026-41859	4 Jun 202601:51	–	vulnrichment

[
  {
    "vendor": "Cloud Foundry Foundation",
    "product": "BOSH",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "282.1.9",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
cloudfoundry	www.cloudfoundry.org/blog/cve-2026-41859-missing-tls-in-nats-sync/

Parameter	Position	Path	Description	CWE
Authorization	path	/info	MITM can steal credentials and tamper with data for /info call due to insufficient TLS validation.	CWE-295
Authorization	path	/deployments	MITM can steal credentials and tamper with deployments data retrieved from /deployments.	CWE-295
Authorization	path	/deployments/<name>/vms	MITM can steal credentials and tamper with the VM list returned for a deployment via /deployments/<name>/vms.	CWE-295

17 Jun 2026 10:47Current

5.8Medium risk

Vulners AI Score5.8

CVSS 47.1

CVSS 3.17.8

EPSS0.00098

SSVC

CWE-295