CVE-2026-47826 is a path traversal in how the BOSH CLI handles the path key in blobs.yml, scored CVSS 9.1 (critical). It can allow arbitrary file writes and the exfiltration of sensitive information. Cloud Foundry fixed it in BOSH CLI v7.10.4, so upgrade any copy older than that.
What's affected
Cloud Foundry's advisory says all BOSH CLI versions before v7.10.4 are affected, and v7.10.4 or later is the fix. It lists no other workarounds.
The Cloud Foundry post rates the issue High, with CVSS v4 8.5 and CVSS v3 8.8. The NVD record scores it 9.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Scores differ between sources because they assume different conditions, so use them to rank work, not to compare.
The tool is a command line client used by operators and in CI pipelines that build and release BOSH releases, which is where blobs.yml files live.
How to check if you're exposed
Check the CLI version on every workstation, build agent and image where it is installed.
bosh --version
The output shows the version and build. Anything below 7.10.4 is affected.
For CI, look at the step that installs or downloads the CLI and the version it pins. Container images used by pipelines can carry an old binary even when laptops are current.
Also list repositories that contain a config/blobs.yml file. Those are the inputs the advisory concerns, and they are worth reviewing for anything that came from a source you do not trust.
What to do now
- Run
bosh --versionon operator machines and pipeline agents and record the results. - Upgrade to v7.10.4 or later and update any pinned version in CI.
- Rebuild images that bundle the CLI.
- Review blobs.yml files in repositories that accept outside contributions before running the CLI against them.
- Run the CLI as a user without access to secrets it does not need, and keep credentials out of the working directory.
Why it matters
The weakness is CWE-22, path traversal. A path value read from a configuration file is used to decide where files are written or read, and it can point outside the directory the tool means to stay in. The advisory says this lets an attacker write arbitrary files and exfiltrate sensitive information.
It matters because the input is a file in a repository, and developer tools often run on trusted machines with access to credentials. Running such a tool against a repository you did not write is the situation to avoid. The record's KEV flag is false.
Quick check
Is CVE-2026-47826 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Which BOSH CLI version fixes it?
Version 7.10.4. Anything earlier is affected, per the Cloud Foundry advisory.
Sources
Last reviewed: 19 October 2026.
