CVE-2026-41857: CloudFoundry BOSH CLI shell injection in SSH and SCP commands

CVE-2026-41857 · Severity: high · CVSS 7.8 · Published 2026-07-09

A security vulnerability in the BOSH command-line tool allows a compromised management server to take control of an administrator's computer. When an operator uses standard commands to manage remote systems, the server can secretly send back malicious instructions that execute with the operator's full permissions. This could lead to the theft of sensitive credentials or a total compromise of the administrator's workstation.

Technologies: Cloud Foundry BOSH CLI. Vendors: Cloud Foundry.

Quick answers

Is CVE-2026-41857 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41857 being exploited in the wild.
How severe is CVE-2026-41857?
High severity, with a CVSS score of 7.8, published 9 July 2026.
Which products and versions are affected?
Cloud Foundry BOSH CLI versions prior to 7.10.5.
Is there a fix for CVE-2026-41857?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41857 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-41857?
Check whether you run Cloud Foundry BOSH CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A shell injection vulnerability exists in the BOSH CLI when interacting with a BOSH Director. The root cause is insufficient sanitization of responses from the Director during the execution of 'bosh ssh', 'bosh scp', or 'bosh logs -f' commands. An attacker who has compromised the BOSH Director can craft malicious responses that trigger arbitrary command execution on the operator's local workstation via the CLI. This requires the operator to initiate a connection to the malicious Director using default flags. The issue is resolved in BOSH CLI version 7.10.5.

Affected products

  • CloudFoundry BOSH CLI versions prior to 7.10.5

Timeline

  • 2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
  • 2026-07-09: disclosed: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.