BOSH vSphere CPI: missing certificate pinning lets an interceptor impersonate vCenter and capture admin credentials

Impact

The CPI authenticates to the vCenter REST API with HTTP Basic credentials but does not properly validate or pin the server certificate, so anyone positioned on the path between the BOSH Director and vCenter can stand up an impersonating endpoint and read the vCenter administrator username and password in the clear. Those credentials normally carry full administrative control of the virtualization estate, which means every VM, datastore, and network the CPI manages - including any GPU-passthrough or vGPU-backed VMs - falls to the attacker. The advisory states the exposure occurs on every CPI call during routine deployment operations, not only in a narrow configuration, and that supplying a CA certificate alone does not mitigate it.

Who can reach it

An attacker able to intercept or redirect traffic between the BOSH Director and vCenter - in practice someone with a position on the management network segment carrying that path. No prior authentication to either endpoint is needed.

What to do

Apply the fixed bosh-vsphere-cpi-release identified in the Cloud Foundry advisory and redeploy the Director so the CPI picks it up; the NVD record names no fixed version, so take it from the advisory. Treat the vCenter credentials used by the CPI as exposed and rotate them after patching. Until then, ensure the Director-to-vCenter path does not traverse any segment an attacker could occupy - a CA certificate alone is explicitly not a mitigation.

References

Related entries

• OpenTelemetry Operator TargetAllocator: a tenant ServiceMonitor can exfiltrate the Collector's service-account tokenCVE-2026-47701 · OpenTelemetry Operator TargetAllocator (ServiceMonitor bearerTokenFile handling)High
• Dell OpenManage Server Administrator (improper authentication): An unauthenticated remote attacker gets unauthorizedCVE-2026-56793 · Dell OpenManage Server Administrator (improper authentication)High
• Ansible AWX: notification backends allow SSRF from the control node and leak webhook credentialsCVE-2026-71366 · Ansible AWX notification backends (webhook, Mattermost, Rocket.Chat, Grafana)High
• Grafana Alloy: ServiceMonitor bearerTokenFile reads any file and ships it to an attacker scrape targetCVE-2026-75889 · Grafana Alloy (prometheus.operator.servicemonitors component)High
• GitLab EE: stale pipeline execution policies run CI/CD with the new group's privileges after project transferCVE-2026-81839 · GitLab EE (scheduled pipeline execution policy records, project transfer cleanup)High
• Ansible automation-controller: survey length-validation error leaks a stored password in plaintextCVE-2026-84499 · Red Hat Ansible Automation Platform automation-controller (survey password validation error)High