Executive brief
A vulnerability in the BOSH command-line tool (bosh-cli) could allow a compromised management server to take control of an administrator's computer. When an operator runs common commands like 'bosh ssh' or 'bosh logs', the server can send malicious instructions that execute unauthorized code on the operator's local workstation. This could lead to the theft of sensitive credentials or full system compromise of the administrator's machine.
Technical details
An argument injection vulnerability exists in bosh-cli versions prior to v7.10.4. The flaw occurs when the CLI handles non-interactive SSH paths, such as 'bosh ssh -c' or 'bosh logs -f'. A compromised BOSH Director can return malicious metadata that is improperly sanitized before being passed to the local OpenSSH client. By injecting arbitrary SSH options (such as ProxyCommand), an attacker can achieve remote code execution (RCE) on the operator's workstation. This attack requires the operator to initiate an SSH-based command against a compromised or malicious Director. The issue is resolved in bosh-cli v7.10.4.
Affected products
- CloudFoundry Foundation bosh-cli versions prior to v7.10.4
Timeline
- 2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
- 2026-07-09: disclosed: CVE published to NVD dataset