Argument Injection in bosh-cli via OpenSSH Options

Executive Summary

CVE-2026-47829 is a high-severity vulnerability in the bosh-cli tool affecting versions prior to v7.10.4. It involves argument injection where a compromised BOSH Director can insert arbitrary OpenSSH options into the SSH process that is locally spawned when an operator runs commands such as "bosh ssh -c" or "bosh logs -f". This injection allows the attacker to execute commands locally on the operator's workstation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to local command execution on the operator's workstation. If an attacker compromises the BOSH Director, they can inject malicious SSH options that execute arbitrary commands on the operator's machine, potentially leading to unauthorized access, data compromise, or further system compromise.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability CVE-2026-47829, it is recommended to upgrade the bosh-cli tool to version v7.10.4 or later.

Useful 0 Not Useful 0