CVE-2026-41009: Local Blobstore may allow arbitrary reads/deletes
When the director sends a long-running request (e.g. compilepackage), the agent's reply JSON is consumed by AgentClient. injectcompilelog (line 332-339) reads response['value']['result']['compilelogid'] and formatexception (line 318-325) reads exception['blobstoreid']; both pass the agent-supplied string unmodified to downloadanddeleteblob(blobid) (line 344-349), which calls @resourcemanager.getresource(blobid) and, in an ensure block, @resourcemanager.deleteresource(blobid). Api::ResourceManager forwards the id straight to blobstore.get(id) / blobstore.delete(id). When the director is configured with the local blobstore provider, Blobstore::LocalClient#objectfilepath(oid) is File.join(@blobstorepath, oid) (localclient.rb:54-56) with no normalisation, so oid = "../../jobs/director/config/director.yml" resolves outside the blobstore root.
Affected versions: BOSH Director: All versions prior to v282.1.12
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41009?
CVE-2026-41009 has a medium severity rating of 4.3.
What is CVE-2026-41009 about?
CVE-2026-41009 involves a potential vulnerability in the Cloud Foundry BOSH Director where the local Blobstore may permit arbitrary reads and deletes.
How do I fix CVE-2026-41009?
To mitigate CVE-2026-41009, ensure that you are using the latest version of Cloud Foundry BOSH Director that addresses this vulnerability.
What systems are affected by CVE-2026-41009?
CVE-2026-41009 affects the Cloud Foundry BOSH Director software.
What is the potential impact of CVE-2026-41009?
The potential impact of CVE-2026-41009 includes unauthorized access to data through arbitrary reads and deletes in the local Blobstore.