CVE-2026-41857: Cloudfoundry Bosh CLI

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI versions prior to 7.10.5.

Affected products

• Cloudfoundry Bosh CLI: before 7.10.5 (fixed in 7.10.5)

Published 2026-07-09. Last modified 2026-07-13.