BOSH vSphere CPI: missing certificate pinning lets an interceptor impersonate vCenter and capture admin credentials

Impact

The CPI authenticates to the vCenter REST API with HTTP Basic credentials but does not properly validate or pin the server certificate, so anyone positioned on the path between the BOSH Director and vCenter can stand up an impersonating endpoint and read the vCenter administrator username and password in the clear. Those credentials normally carry full administrative control of the virtualization estate, which means every VM, datastore, and network the CPI manages - including any GPU-passthrough or vGPU-backed VMs - falls to the attacker. The advisory states the exposure occurs on every CPI call during routine deployment operations, not only in a narrow configuration, and that supplying a CA certificate alone does not mitigate it.

Who can reach it

An attacker able to intercept or redirect traffic between the BOSH Director and vCenter - in practice someone with a position on the management network segment carrying that path. No prior authentication to either endpoint is needed.

What to do

Apply the fixed bosh-vsphere-cpi-release identified in the Cloud Foundry advisory and redeploy the Director so the CPI picks it up; the NVD record names no fixed version, so take it from the advisory. Treat the vCenter credentials used by the CPI as exposed and rotate them after patching. Until then, ensure the Director-to-vCenter path does not traverse any segment an attacker could occupy - a CA certificate alone is explicitly not a mitigation.

References

Related entries

• Dell OpenManage Server Administrator (improper authentication): An unauthenticated remote attacker gets unauthorizedCVE-2026-56793 · Dell OpenManage Server Administrator (improper authentication)High
• Ansible AWX: notification backends allow SSRF from the control node and leak webhook credentialsCVE-2026-71366 · Ansible AWX notification backends (webhook, Mattermost, Rocket.Chat, Grafana)High
• Grafana Alloy: ServiceMonitor bearerTokenFile reads any file and ships it to an attacker scrape targetCVE-2026-75889 · Grafana Alloy (prometheus.operator.servicemonitors component)High
• GlusterFS (brick, mknod): Mknod can create device nodes that point at real devices on the storage server, so a clientCVE-2018-10923 · GlusterFS (brick, mknod)High
• HashiCorp Vault: GCP secrets engine drops existing IAM Conditions when creating/updating rolesetsCVE-2023-5077 · HashiCorp VaultHigh
• NetApp ONTAP 9 role-based access control: A user holding several remote accounts with different roles performs actionsCVE-2024-21985 · NetApp ONTAP 9 role-based access controlHigh