Skip to main content

BOSH CLI CVE-2026-41857

| EUVDEUVD-2026-42505 HIGH
OS Command Injection (CWE-78)
2026-07-09 vmware GHSA-xf9x-r7gm-j3j6
Bosh Cli Command Injection
7.1
CVSS 4.0 · Vendor: vmware
Share

Severity by source

Vendor (vmware) PRIMARY
7.1 HIGH
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Payload is delivered over the network from the Director (AV:N) but needs a preexisting Director compromise plus operator action, so AC:H and UI:R; full workstation compromise gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

2
Patch available
Jul 09, 2026 - 07:01 EUVD
Analysis Generated
Jul 09, 2026 - 05:59 vuln.today

DescriptionCVE.org

A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI versions prior to 7.10.5.

AnalysisAI

Arbitrary command execution on operator workstations in Cloud Foundry BOSH CLI before 7.10.5 allows a compromised or malicious BOSH Director to inject and run shell commands locally when an operator invokes bosh ssh, bosh scp, or bosh logs -f with default flags. Because the CLI trusts director-supplied data and passes it into a shell, a controlled director turns a routine operator action into local code execution on the trusted management host. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Compromise or impersonate BOSH Director
Delivery
Plant malicious connection metadata
Exploit
Operator runs bosh ssh with default flags
Execution
CLI builds shell command from director data
Persist
Injected commands execute on workstation
Impact
Pivot using operator credentials
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two concrete prerequisites drawn directly from the description: (1) the BOSH Director the CLI connects to must be compromised or malicious - a benign Director cannot trigger this, and (2) the operator must actively run one of the specific commands bosh ssh, bosh scp, or bosh logs -f with default flags, so the flaw fires under default configuration once those commands are used. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.1 (AV:L/AC:L/AT:P/PR:N/UI:A) reflects a meaningful but conditional risk: exploitation is not automatable and hinges on a preexisting compromise of the Director (AT:P attack requirement) plus an active operator action (UI:A). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has compromised a BOSH Director (or stands up a rogue one that an operator is lured into targeting) plants malicious connection metadata that the CLI will interpret. When the operator runs bosh ssh with default flags to reach a deployment VM, the CLI builds a local shell command from that director-supplied data and executes the attacker's injected commands on the operator's workstation. …
Remediation Upgrade the BOSH CLI on every operator workstation and CI/automation host to version 7.10.5 or later (Vendor-released patch: 7.10.5), per the Cloud Foundry advisory at https://www.cloudfoundry.org/blog/cve-2026-41857-bosh-cli-shell-injection/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all BOSH CLI deployments and identify instances running versions before 7.10.5. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Bosh Cli

View all
CVE-2026-47828 HIGH
8.9 Jul 09

Man-in-the-middle credential theft and root code execution affects the BOSH CLI (bosh-cli) prior to v7.10.4, which fails
CVE-2018-1231 HIGH
8.8 Mar 27

Cloud Foundry BOSH CLI, versions prior to v3.0.1, contains an improper access control vulnerability. Rated high severity
CVE-2026-47829 HIGH
7.7 Jul 09

Argument injection in bosh-cli versions before v7.10.4 lets a compromised or malicious BOSH Director inject arbitrary Op

Same weakness CWE-78 – OS Command Injection

View all
CVE-2014-6271 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6
CVE-2014-7169 CRITICAL POC
9.8
CVE-2017-6884 HIGH POC
8.8
CVE-2017-6077 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Share

CVE-2026-41857 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy