PT-2026-56696 · Bosh Cli · Bosh Cli

Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-41857

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BOSH CLI versions prior to 7.10.5

Description A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation. This occurs when the operator uses the bosh ssh, bosh scp, or bosh logs -f commands with default flags.

Recommendations Update BOSH CLI to version 7.10.5 or later.

Fix

Related Identifiers

CVE-2026-41857

Affected Products

Bosh Cli

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-41857 · Security Note
• https://cloudfoundry.org/blog/cve-2026-41857-bosh-cli-shell-injection · Note
• https://twitter.com/CVEnew/status/2075092516387340700 · Twitter Post