CVE-2026-47829
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An argument injection vulnerability in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned SSH process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation.
Risk Assessment
The risk is that an attacker controlling the BOSH Director can take over the operator's workstation, potentially leading to data theft, privilege escalation, or further propagation of the attack within the internal network.
Recommendation
Immediately upgrade bosh-cli to version v7.10.4 or later, which contains the fix for this vulnerability. Until the update is applied, avoid using non-interactive SSH commands with bosh-cli.
Other vulnerabilities in bosh-cli
See all- CVE-2026-47826Critical
A path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information via the blobs.yml file. Affected versions are prior to v7.10.4.
- CVE-2026-47827High
Command Injection in BOSH CLI tool on Windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities.
- CVE-2026-47828High
A vulnerability in BOSH CLI (versions prior to 7.10.4) causes the client to skip server certificate verification for DAV blobstore during create-env and delete-env operations, allowing a network attacker to intercept Basic-auth credentials and read the rendered-templates archive containing all bootstrap secrets for the new BOSH Director.
- CVE-2026-41857High
A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI prior to 7.10.5.
Original NVD description (English source)
Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation. Affected versions: bosh-cli versions prior to v7.10.4.