CVE-2026-41857
Received Received - Intake

Arbitrary Command Execution in BOSH CLI

Publication date: 2026-07-09

Last updated on: 2026-07-09

Assigner: VMware

Description
A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI versions prior to 7.10.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-09
Last Modified
2026-07-09
Generated
2026-07-09
AI Q&A
2026-07-09
EPSS Evaluated
N/A
NVD
CVE-2026-41857
EUVD
EUVD-2026-42505

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vmware tanzu_bosh_cli to 7.10.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-41857 is a high-severity vulnerability in the BOSH CLI tool used with Cloud Foundry. It involves shell injection, where a compromised or malicious BOSH Director can execute arbitrary shell commands on an operator's workstation.

This happens when the operator runs commands like `bosh ssh`, `bosh scp`, or `bosh logs -f` with default flags on BOSH CLI versions prior to 7.10.5.

Impact Analysis

The vulnerability allows a malicious BOSH Director to execute arbitrary shell commands on the operator's workstation, potentially leading to unauthorized access, data compromise, or system control.

This can result in high impact on confidentiality, integrity, and availability of the operator's system and data.

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade the BOSH CLI to version 7.10.5 or later.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41857. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart