CVE-2026-41009 Overview
CVE-2026-41009 is a path traversal vulnerability [CWE-22] in the BOSH Director component of Cloud Foundry. The flaw exists in how the Director processes agent replies for long-running requests such as compile_package. The AgentClient class consumes JSON returned by the agent and passes attacker-controlled identifiers directly to the local blobstore client. When the Director uses the local blobstore provider, Blobstore::LocalClient#object_file_path joins the supplied identifier with the blobstore root without normalisation. A crafted blob identifier resolves outside the blobstore directory, enabling arbitrary file reads and deletes on the Director host.
Critical Impact
A compromised or malicious BOSH agent can read and delete arbitrary files accessible to the Director process, including director.yml, which may contain sensitive configuration and credentials.
Affected Products
- BOSH Director versions prior to v282.1.12
- Cloud Foundry deployments configured with the local blobstore provider
- Cloud Foundry environments managed by the affected BOSH Director
Discovery Timeline
- 2026-05-27 - CVE-2026-41009 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-41009
Vulnerability Analysis
The vulnerability resides in the Director's handling of agent-supplied blob identifiers. When the Director issues a long-running task such as compile_package, the agent returns a JSON reply containing identifier fields. The inject_compile_log method (lines 332-339) reads response['value']['result']['compile_log_id'], and format_exception (lines 318-325) reads exception['blobstore_id']. Both methods forward the agent-supplied string unchanged to download_and_delete_blob(blob_id) at lines 344-349.
The download_and_delete_blob routine calls @resource_manager.get_resource(blob_id) and, inside an ensure block, @resource_manager.delete_resource(blob_id). Api::ResourceManager forwards the identifier directly to blobstore.get(id) and blobstore.delete(id) without validation. Exploitation requires control of an agent or the ability to inject crafted reply JSON, making the attack vector local with high attack complexity.
Root Cause
The root cause is missing input normalisation in Blobstore::LocalClient#object_file_path(oid) at local_client.rb:54-56. The function calls File.join(@blobstore_path, oid) without rejecting traversal sequences. Supplying an oid such as ../../jobs/director/config/director.yml causes File.join to resolve a path outside the configured blobstore root.
Attack Vector
An attacker controlling a BOSH agent, or capable of tampering with agent replies on the network path, returns a malicious compile_log_id or blobstore_id value. The Director reads the targeted file through get_resource and then deletes it through the ensure clause of download_and_delete_blob. The destructive delete step runs regardless of whether the read succeeded, amplifying the impact to file removal even when the read fails.
The vulnerability manifests in the Director's blob handling path. See the Cloud Foundry Blog Post for the upstream advisory and code references.
Detection Methods for CVE-2026-41009
Indicators of Compromise
- Agent reply JSON containing compile_log_id or blobstore_id values with ../ sequences or absolute paths
- Unexpected file access or deletion under /var/vcap/jobs/director/config/ or other Director-owned directories
- Director task logs showing download_and_delete_blob calls referencing identifiers that do not match standard UUID blob naming
Detection Strategies
- Inspect Director task and debug logs for blob identifiers containing path separators, .., or non-UUID characters
- Audit the local blobstore directory for unexplained file deletions or missing configuration files
- Compare agent reply payloads against expected schemas and flag identifier fields that deviate from UUID format
Monitoring Recommendations
- Enable file integrity monitoring on /var/vcap/jobs/director/config/director.yml and surrounding Director configuration paths
- Forward Director and agent logs to a centralised analytics pipeline and alert on traversal patterns in blob identifier fields
- Monitor for repeated compile_package failures followed by file access errors, which may indicate exploitation attempts
How to Mitigate CVE-2026-41009
Immediate Actions Required
- Upgrade BOSH Director to v282.1.12 or later, which adds identifier normalisation in the local blobstore client
- Restrict network access between agents and the Director to trusted management networks only
- Rotate any credentials stored in director.yml or other Director configuration files if compromise is suspected
Patch Information
The Cloud Foundry project released BOSH Director v282.1.12 to remediate the issue. The patch validates blob identifiers before passing them to the local blobstore client, rejecting values that contain traversal sequences or resolve outside the configured blobstore root. Refer to the Cloud Foundry Blog Post for upgrade guidance.
Workarounds
- Switch the Director to an external blobstore provider such as S3-compatible storage, which does not use File.join against attacker-controlled identifiers
- Apply strict filesystem permissions so the Director process cannot read or delete sensitive files outside the blobstore root
- Add network controls or proxy validation to reject agent replies whose identifier fields are not valid UUIDs
# Verify installed BOSH Director version
bosh -e <environment> environment
# Upgrade the Director deployment to a fixed release
bosh -e <environment> deploy bosh-deployment/bosh.yml \
-v director_version=282.1.12
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
