CVE-2026-41704: Compromised VM can make arbitrary blobstore deletes
AgentClient#handlemethod (lines 264-303) processes every NATS reply. It calls injectcompilelog (line 273) on every response, which reads response['value']['result']['compilelogid'] (line 332-338) and passes it to downloadanddeleteblob. Separately, any response containing 'exception' goes through formatexception (lines 308-325), which reads exception['blobstoreid'] and also calls downloadanddeleteblob. That helper (lines 344-349) calls ResourceManager#getresource(blobid) and, in an ensure block, ResourceManager#deleteresource(blobid). ResourceManager (resourcemanager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix.
Affected versions: BOSH Director: All versions prior to v282.1.12
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41704?
The severity of CVE-2026-41704 is medium with a score of 6.8.
What types of systems are affected by CVE-2026-41704?
CVE-2026-41704 affects the Cloud Foundry BOSH Director.
How do I fix CVE-2026-41704?
To fix CVE-2026-41704, you should update the Cloud Foundry BOSH Director to the latest version that addresses this vulnerability.
What is the impact of exploiting CVE-2026-41704?
Exploiting CVE-2026-41704 allows a compromised VM to delete arbitrary entries from the blobstore.
What component of Cloud Foundry BOSH Director is affected by CVE-2026-41704?
The AgentClient's method handling process is affected by CVE-2026-41704, particularly in how it processes NATS replies.