Executive brief
A security vulnerability in the BOSH command-line tool allows a compromised management server to take control of an administrator's computer. When an operator uses standard commands to manage remote systems, the server can secretly send back malicious instructions that execute with the operator's full permissions. This could lead to the theft of sensitive credentials or a total compromise of the administrator's workstation.
Technical details
A shell injection vulnerability exists in the BOSH CLI when interacting with a BOSH Director. The root cause is insufficient sanitization of responses from the Director during the execution of 'bosh ssh', 'bosh scp', or 'bosh logs -f' commands. An attacker who has compromised the BOSH Director can craft malicious responses that trigger arbitrary command execution on the operator's local workstation via the CLI. This requires the operator to initiate a connection to the malicious Director using default flags. The issue is resolved in BOSH CLI version 7.10.5.
Affected products
- CloudFoundry BOSH CLI versions prior to 7.10.5
Timeline
- 2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
- 2026-07-09: disclosed: CVE published to NVD dataset