The vulnerability originates from argument injection in the BOSH CLI. A compromised BOSH Director can inject arbitrary OpenSSH options into a locally spawned ssh process when an operator executes non‑interactive SSH commands such as bosh ssh -c or bosh logs -f. The injected options are passed to the underlying ssh binary, causing the operator's workstation to run unintended local commands. This flaw results in local command execution on the operator's machine, compromising confidentiality and integrity of the workstation and potentially all data stored there.

CloudFoundry Foundation's BOSH CLI versions prior to 7.10.4 are affected. Operators using these releases should be aware that the CLI's handling of SSH options is insecure until they upgrade to 7.10.4 or later.

The CVSS score of 7.7 classifies the issue as high severity, while the EPSS score of less than 1 % indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. Attacks require the adversary to first compromise the BOSH Director and then cause an operator to run a vulnerable non‑interactive SSH command, after which injected SSH options trigger local command execution on the workstation.