BOSH CLI CVE-2026-41857

Exploitation requires two concrete prerequisites drawn directly from the description: (1) the BOSH Director the CLI connects to must be compromised or malicious - a benign Director cannot trigger this, and (2) the operator must actively run one of the specific commands bosh ssh, bosh scp, or bosh logs -f with default flags, so the flaw fires under default configuration once those commands are used. Limiting factors that reduce real-world risk: the attack is gated on already owning or impersonating the Director (a significant precondition), requires human operator interaction (UI:A) rather than being remotely automatable, and only affects BOSH CLI versions before 7.10.5. It does not require any credentials on the victim workstation itself (PR:N).

The CVSS 4.0 score of 7.1 (AV:L/AC:L/AT:P/PR:N/UI:A) reflects a meaningful but conditional risk: exploitation is not automatable and hinges on a preexisting compromise of the Director (AT:P attack requirement) plus an active operator action (UI:A). The upside for defenders is that a benign, properly secured Director cannot trigger this - the threat model requires the Director itself to be malicious or already breached, making this primarily a lateral-movement / privilege-pivot concern rather than a mass-exploitation one. The downside is severity: the victim is a privileged operator workstation, and success yields high confidentiality, integrity, and availability impact (VC/VI/VA:H) on a host that typically holds credentials to the entire platform. No EPSS score, KEV entry, or POC was provided, so widespread automated exploitation is not indicated. Note a signal to verify: the vendor rated AV:L, but the malicious payload is delivered over the network connection from the Director to the CLI - an argument for AV:N with elevated complexity - so treat the local-vector framing as one defensible interpretation rather than settled fact.

An attacker who has compromised a BOSH Director (or stands up a rogue one that an operator is lured into targeting) plants malicious connection metadata that the CLI will interpret. When the operator runs bosh ssh with default flags to reach a deployment VM, the CLI builds a local shell command from that director-supplied data and executes the attacker's injected commands on the operator's workstation. No separate exploit tooling is required beyond control of the Director; no public POC has been published at time of analysis.