High severity7.8NVD Advisory· Published Jul 9, 2026· Updated Jul 13, 2026
CVE-2026-41857
CVE-2026-41857
Description
A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI versions prior to 7.10.5.
Affected products
2<7.10.5+ 1 more
- (no CPE)range: <7.10.5
- cpe:2.3:a:cloudfoundry:bosh_cli:*:*:*:*:*:*:*:*range: <7.10.5
Patches
Vulnerability mechanics
References
1- www.cloudfoundry.org/blog/cve-2026-41857-bosh-cli-shell-injection/nvdVendor Advisory
News mentions
0No linked articles in our index yet.