CVE-2026-41011 | Cloud Foundry BOSH up to 282.1.11 Exec.sh Bosh::Common::Exec.sh package_meta[‘name’] os command injection

A vulnerability described as critical has been identified in Cloud Foundry BOSH up to 282.1.11. This issue affects the function Bosh::Common::Exec.sh of the file Exec.sh. Such manipulation of the argument package_meta[‘name’] leads to os command injection.

This vulnerability is referenced as CVE-2026-41011. The attack can only be performed from a local environment. No exploit is available.

Upgrading the affected component is recommended.