Vulnerability · Published Jul 9, 2026 · Assigned by vmware
CVE-2026-41857BOSH CLI Shell Injection
High 7.8
In plain English
A high-severity security flaw in BOSH CLI from CloudFoundry BOSH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.0)7.8High
Exploit odds (30 days)0.2%top 86.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI versions prior to 7.10.5.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CloudFoundry BOSH | BOSH CLI | 0 – before 7.10.5 |