{"id":"CVE-2026-47832","kind":"vulnerability","aliases":["CVE-2026-47832"],"related":[],"title":"BOSH OpenStack CPI: application credentials mishandled in deployments","description":"The vulnerability lies in the way application credentials are handled within the BOSH deployment.\nbosh-openstack-cpi-release: all versions from v55 to v55.0.4 (inclusive)","summary":"The bosh-openstack-cpi-release mishandles application credentials inside BOSH deployments, per the NVD description. The sources do not say exactly what an attacker can read or do with them.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bosh-openstack-cpi-release","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bosh","cloud-foundry","openstack","package"],"not_affected_if":["other-cpi"],"how_to_check":"- Check whether the deployment uses `bosh-openstack-cpi-release` and which version it pins, looking at the release version in the BOSH manifest or `bosh releases`.\n- Treat any version from `v55` to `v55.0.4` as affected.","fix":"- `bosh-openstack-cpi-release` versions after `v55.0.4` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-11-12T08:16:41+00:00","first_seen_at":"2026-11-12T08:37:15+00:00","triaged_at":"2026-11-12T08:38:34+00:00","updated_at":"2026-11-12T08:38:34+00:00","category":"package","confidence":0.35,"triage":{"at":"2026-11-12T08:38:34Z","model":"claude-haiku-5-5","output":{"fix":"- `bosh-openstack-cpi-release` versions after `v55.0.4` (the sources do not name the exact fixed release)","reach":"unknown","title":"BOSH OpenStack CPI: application credentials mishandled in deployments","impact":"high","summary":"The bosh-openstack-cpi-release mishandles application credentials inside BOSH deployments, per the NVD description. The sources do not say exactly what an attacker can read or do with them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["bosh","openstack","cloud-foundry"],"confidence":0.35,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; application credentials may be exposed","analyst_note":"Find the NVD entry's CVSS vector and the upstream bosh-openstack-cpi-release advisory to confirm the fixed version and how credentials leak.","how_to_check":"- Check whether the deployment uses `bosh-openstack-cpi-release` and which version it pins, looking at the release version in the BOSH manifest or `bosh releases`.\n- Treat any version from `v55` to `v55.0.4` as affected.","plain_action":"","product_name":"bosh-openstack-cpi-release","needs_analyst":true,"not_affected_if":["other-cpi"],"who_is_affected":"Teams that deploy with BOSH and the OpenStack CPI release at versions v55 through v55.0.4 are in scope. The sources do not describe the exact exposure path, so unknown whether the flaw needs a particular feature or credential setup.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4506,"output_tokens":596,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-47832':11A,14A 'applic':4A,33B,59C 'attack':50B 'bosh':1A,16A,20B,28B,36B,65C,68C 'bosh-openstack-cpi-releas':27B,67C 'bosh-openstack-cpi-release':15A 'cloud':22B 'cloud-foundri':21B 'cpi':3A,18A,30B,70C 'credenti':5A,34B,60C 'cve':9A,12A 'deploy':8A,37B,66C 'descript':41B 'exact':47B 'foundri':23B 'handl':62C 'inclus':78C 'insid':35B 'lie':55C 'mishandl':6A,32B 'nvd':40B 'openstack':2A,17A,24B,29B,69C 'packag':25B 'per':38B 'read':52B 'releas':31B,71C 'release':19A 'say':46B 'sourc':43B 'v55':75C 'v55.0.4':77C 'version':73C 'vulner':54C 'way':58C 'within':63C","nicknames":[],"mitigations":[],"who_affected":"Teams that deploy with BOSH and the OpenStack CPI release at versions v55 through v55.0.4 are in scope. The sources do not describe the exact exposure path, so unknown whether the flaw needs a particular feature or credential setup.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["boshopenstackcpirelease"],"ptokens":["bosh","cpi","openstack","release"],"labels":["bosh","cloudfoundry","high","openstack","package","vendor"],"campaign_type":null,"search_a":"'-2026':10A,13A '-47832':11A,14A 'applic':4A 'bosh':1A,16A 'bosh-openstack-cpi-release':15A 'cpi':3A,18A 'credenti':5A 'cve':9A,12A 'deploy':8A 'mishandl':6A 'openstack':2A,17A 'release':19A","search_b":"'applic':33B 'attack':50B 'bosh':20B,28B,36B 'bosh-openstack-cpi-releas':27B 'cloud':22B 'cloud-foundri':21B 'cpi':30B 'credenti':34B 'deploy':37B 'descript':41B 'exact':47B 'foundri':23B 'insid':35B 'mishandl':32B 'nvd':40B 'openstack':24B,29B 'packag':25B 'per':38B 'read':52B 'releas':31B 'say':46B 'sourc':43B","search_c":"'applic':59C 'bosh':65C,68C 'bosh-openstack-cpi-releas':67C 'cpi':70C 'credenti':60C 'deploy':66C 'handl':62C 'inclus':78C 'lie':55C 'openstack':69C 'releas':71C 'v55':75C 'v55.0.4':77C 'version':73C 'vulner':54C 'way':58C 'within':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T08:16:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@vmware.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-47832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47832","severity":null,"published_at":"2026-11-12T08:16:41+00:00","modified_at":"2026-11-12T08:16:41+00:00","first_seen_at":"2026-11-12T08:37:15+00:00","fetched_at":"2026-11-12T08:37:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}