---
id: CVE-2026-47829
title: >-
  Argument Injection in bosh-cli allows a compromised BOSH Director to inject
  arbitrary OpenSSH options into the locally-spawned ssh process when an
  operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths,
  leading to lo…
summary: >-
  Argument Injection in bosh-cli allows a compromised BOSH Director to inject
  arbitrary OpenSSH options into the locally-spawned ssh process when an
  operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths,
  leading to lo…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-88
vendor: cloudfoundry
product: bosh_cli
affected:
  - bosh_cli < 7.10.4
patched:
  - bosh_cli 7.10.4
published: '2026-07-09'
updated: '2026-07-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47829'
references:
  - url: >-
      https://www.cloudfoundry.org/blog/cve-2026-47829-argument-injection-in-bosh-cli-allows-local-command-execution-on-operator-workstations-via-compromised-director/
    label: security@vmware.com
tags:
  - nvd
epss: 0.00419
epssPercentile: 0.35917
ingestedAt: '2026-07-13T14:27:27.130Z'
---

## Overview

Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation.
Affected versions: bosh-cli versions prior to v7.10.4.

## Affected

- `bosh_cli < 7.10.4`

## Remediation

Upgrade past the affected range:

- `bosh_cli 7.10.4`