BOSH-OPENSTACK-CPI-RELEASE · CVE-2026-47832 · Package
NO FIX YET · SEE WHAT TO DO
The bosh-openstack-cpi-release mishandles application credentials inside BOSH deployments, per the NVD description. The sources do not say exactly what an attacker can read or do with them.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that deploy with BOSH and the OpenStack CPI release at versions v55 through v55.0.4 are in scope. The sources do not describe the exact exposure path, so unknown whether the flaw needs a particular feature or credential setup.
Not affected if other-cpi
Who cares bosh, cloud-foundry, openstack
bosh-openstack-cpi-release and which version it pins, looking at the release version in the BOSH manifest or bosh releases.v55 to v55.0.4 as affected.bosh-openstack-cpi-release versions after v55.0.4 (the sources do not name the exact fixed release)The vulnerability lies in the way application credentials are handled within the BOSH deployment. bosh-openstack-cpi-release: all versions from v55 to v55.0.4 (inclusive)
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.