BOSH

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Bosh accepts refresh tokens in place of an access tokenCVE-2018-11083Cloud Foundry · CVSS 8.4 · 1.5% likely
2. Bosh Deployment logs leak sensitive informationCVE-2019-11271Cloud Foundry · CVSS 6 · 0.3% likely

   CWE-532

3. Arbitrary Root File Write via Path Traversal in BOSH agentCVE-2026-41861CloudFoundry Foundation · CVSS 4.2 · 0.2% likely

   CWE-22

4. PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from releas…CVE-2026-41011Cloud Foundry Foundation · CVSS 8.2 · 0.1% likely

   CWE-78

5. A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list tha…CVE-2026-41859Cloud Foundry Foundation · CVSS 7.8 · 0.1% likely

   CWE-295

6. CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request…CVE-2026-41860Cloud Foundry Foundation · CVSS 8.8 · 0.1% likely

   CWE-326

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.