CVE-2026-41704 Details
Description
AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any response containing 'exception' goes through format_exception (lines 308-325), which reads exception['blobstore_id'] and also calls download_and_delete_blob. That helper (lines 344-349) calls ResourceManager#get_resource(blob_id) and, in an ensure block, ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix. Affected versions: BOSH Director: All versions prior to v282.1.12
A vulnerability in Cloud Foundry BOSH Director, all versions prior to v282.1.12, allows a compromised virtual machine (VM) to delete arbitrary data from the shared blobstore. This issue arises because the ResourceManager does not validate blobstore IDs before executing delete commands, enabling an attacker with root access on a VM to manipulate blobstore data without proper checks. The vulnerability can be exploited by responding to Director requests with crafted messages that include blobstore IDs of targeted data, which the Director then fetches and deletes from the blobstore.
Users are advised to upgrade BOSH Director to version v282.1.12 or later. Additionally, implement strict network segmentation between deployment VMs and the Director, monitor blobstore operations for suspicious deletion patterns, consider isolating critical deployments to dedicated BOSH Directors, and apply additional access controls on blobstore operations.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cloudfoundry.org/blog/cve-2026-41704-compromised-vm-can-make-arbitrary-blobstore-deletes/ | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cloud foundry bosh | < 282.1.12 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | New CVE Received | [email protected] |