diff --git a/core/src/main/java/org/elasticsearch/bootstrap/BootstrapCLIParser.java b/core/src/main/java/org/elasticsearch/bootstrap/BootstrapCLIParser.java
index e44e397f67a..f812bda178c 100644
--- a/core/src/main/java/org/elasticsearch/bootstrap/BootstrapCLIParser.java
+++ b/core/src/main/java/org/elasticsearch/bootstrap/BootstrapCLIParser.java
@@ -29,6 +29,7 @@ import org.elasticsearch.cli.ExitCodes;
 import org.elasticsearch.cli.UserError;
 import org.elasticsearch.common.Strings;
 import org.elasticsearch.cli.Terminal;
+import org.elasticsearch.common.SuppressForbidden;
 import org.elasticsearch.monitor.jvm.JvmInfo;
 
 final class BootstrapCliParser extends Command {
@@ -54,6 +55,8 @@ final class BootstrapCliParser extends Command {
             .withRequiredArg();
     }
 
+    // TODO: don't use system properties as a way to do this, its horrible...
+    @SuppressForbidden(reason = "Sets system properties passed as CLI parameters")
     @Override
     protected void execute(Terminal terminal, OptionSet options) throws Exception {
         if (options.has(versionOption)) {
diff --git a/modules/lang-groovy/build.gradle b/modules/lang-groovy/build.gradle
index 89444a4e926..005a7d4be18 100644
--- a/modules/lang-groovy/build.gradle
+++ b/modules/lang-groovy/build.gradle
@@ -38,6 +38,15 @@ thirdPartyAudit.excludes = [
   // for example we do not need ivy, scripts arent allowed to download code
   'com.thoughtworks.xstream.XStream', 
   'groovyjarjarasm.asm.util.Textifiable', 
+  'org.apache.commons.cli.CommandLine',
+  'org.apache.commons.cli.CommandLineParser',
+  'org.apache.commons.cli.GnuParser',
+  'org.apache.commons.cli.HelpFormatter',
+  'org.apache.commons.cli.Option',
+  'org.apache.commons.cli.OptionBuilder',
+  'org.apache.commons.cli.Options',
+  'org.apache.commons.cli.Parser',
+  'org.apache.commons.cli.PosixParser',
   'org.apache.ivy.Ivy', 
   'org.apache.ivy.core.event.IvyListener', 
   'org.apache.ivy.core.event.download.PrepareDownloadEvent', 
diff --git a/plugins/repository-hdfs/build.gradle b/plugins/repository-hdfs/build.gradle
index 915a85ebdc4..20050bdc31e 100644
--- a/plugins/repository-hdfs/build.gradle
+++ b/plugins/repository-hdfs/build.gradle
@@ -191,6 +191,16 @@ thirdPartyAudit.excludes = [
   'org.apache.commons.beanutils.DynaClass', 
   'org.apache.commons.beanutils.DynaProperty', 
   'org.apache.commons.beanutils.PropertyUtils', 
+  'org.apache.commons.cli.CommandLine',
+  'org.apache.commons.cli.CommandLineParser',
+  'org.apache.commons.cli.GnuParser',
+  'org.apache.commons.cli.HelpFormatter',
+  'org.apache.commons.cli.Option',
+  'org.apache.commons.cli.OptionBuilder',
+  'org.apache.commons.cli.OptionGroup',
+  'org.apache.commons.cli.Options',
+  'org.apache.commons.cli.ParseException',
+  'org.apache.commons.cli.PosixParser',
   'org.apache.commons.compress.archivers.tar.TarArchiveEntry', 
   'org.apache.commons.compress.archivers.tar.TarArchiveInputStream', 
   'org.apache.commons.codec.DecoderException',