Is CVE-2026-47829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47829 being exploited in the wild.

How severe is CVE-2026-47829?

High severity, with a CVSS score of 8.3, published 9 July 2026.

Which products and versions are affected?

CloudFoundry Foundation bosh-cli versions prior to v7.10.4.

Is there a fix for CVE-2026-47829?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47829 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47829?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47829: CloudFoundry bosh-cli argument injection in SSH commands

CVE-2026-47829 · Severity: high · CVSS 8.3 · Published 2026-07-09

A vulnerability in the BOSH command-line tool (bosh-cli) could allow a compromised management server to take control of an administrator's computer. When an operator runs common commands like 'bosh ssh' or 'bosh logs', the server can send malicious instructions that execute unauthorized code on the operator's local workstation. This could lead to the theft of sensitive credentials or full system compromise of the administrator's machine.

Quick answers

Is CVE-2026-47829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47829 being exploited in the wild.
How severe is CVE-2026-47829?: High severity, with a CVSS score of 8.3, published 9 July 2026.
Which products and versions are affected?: CloudFoundry Foundation bosh-cli versions prior to v7.10.4.
Is there a fix for CVE-2026-47829?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47829 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47829?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An argument injection vulnerability exists in bosh-cli versions prior to v7.10.4. The flaw occurs when the CLI handles non-interactive SSH paths, such as 'bosh ssh -c' or 'bosh logs -f'. A compromised BOSH Director can return malicious metadata that is improperly sanitized before being passed to the local OpenSSH client. By injecting arbitrary SSH options (such as ProxyCommand), an attacker can achieve remote code execution (RCE) on the operator's workstation. This attack requires the operator to initiate an SSH-based command against a compromised or malicious Director. The issue is resolved in bosh-cli v7.10.4.

Affected products

CloudFoundry Foundation bosh-cli versions prior to v7.10.4

Timeline

2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
2026-07-09: disclosed: CVE published to NVD dataset

References

https://www.cloudfoundry.org/blog/cve-2026-47829-argument-injection-in-bosh-cli-allows-local-command-execution-on-operator-workstations-via-compromised-director/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.