CVE-2026-41010: BOSH Director RCE Vulnerability

CVE-2026-41010 Overview

CVE-2026-41010 is a command injection vulnerability [CWE-78] in the BOSH Director component of Cloud Foundry. The flaw resides in ReleaseJob#unpack, which interpolates an attacker-controlled job name from an uploaded release tarball directly into a shell command. An authenticated user with permission to upload releases can inject shell metacharacters through the jobs: array in release.MF, achieving arbitrary command execution under the BOSH Director process.

Critical Impact
Authenticated attackers can execute arbitrary shell commands on the BOSH Director host by uploading a crafted release tarball, compromising the orchestration plane that manages Cloud Foundry deployments.

Affected Products

BOSH Director versions prior to v282.1.12
Cloud Foundry deployments using vulnerable BOSH Director releases
bosh-common library exposing Bosh::Common::Exec.sh

Discovery Timeline

2026-06-04 - CVE-2026-41010 published to NVD
2026-06-04 - Last updated in NVD database

Technical Details for CVE-2026-41010

Vulnerability Analysis

The vulnerability lives in ReleaseJob#unpack, which constructs two filesystem paths from the job name supplied by the uploaded release manifest. The code computes job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz"), where name returns @job_meta['name'] verbatim from the jobs: array in release.MF.

These paths are then interpolated into a shell command string passed to Bosh::Common::Exec.sh("tar -C #{job_dir} -xf #{job_tgz} 2>&1", :on_error => :return). The Bosh::Common::Exec.sh helper executes commands through %x{#{command}}, which invokes /bin/sh -c. Any shell metacharacters present in the job name are interpreted by the shell rather than treated as literal path components.

Root Cause

The root cause is missing input validation and unsafe shell command construction. FileUtils.mkdir_p(job_dir) on line 49 creates the literal directory without invoking the shell, so names containing $(), ;, or backticks pass through directory creation successfully. Execution then reaches the vulnerable sh call, where the same characters become active shell syntax. The application trusts attacker-controlled YAML metadata as safe input to a command-line concatenation pattern.

Attack Vector

An attacker with privileges to upload a BOSH release crafts a tarball whose release.MF declares a job entry with a malicious name field, for example a value containing command substitution syntax such as $(...) or shell separators such as ;. When the Director processes the release, mkdir_p accepts the literal name, then Bosh::Common::Exec.sh executes the interpolated string through /bin/sh -c, running the injected commands with the privileges of the Director process.

No verified public exploit code is available. Refer to the Cloud Foundry Blog Post for additional technical context.

Detection Methods for CVE-2026-41010

Indicators of Compromise

Unexpected child processes spawned by the BOSH Director process tree, particularly /bin/sh -c invocations containing unusual operators in tar arguments.
Release tarballs whose release.MFjobs: entries contain shell metacharacters such as $(), backticks, ;, |, or & in the name field.
Anomalous outbound network connections or filesystem changes originating from the Director immediately following a release upload.

Detection Strategies

Inspect BOSH Director audit logs for upload-release actions and correlate them with process execution telemetry on the host.
Validate release manifests at ingestion by parsing release.MF and rejecting job names that do not match a strict allowlist such as [A-Za-z0-9_-]+.
Monitor for shell processes whose command line contains tar -C followed by unexpected characters in the directory or archive argument.

Monitoring Recommendations

Forward Director host process, file, and network telemetry to a centralized analytics platform for retroactive hunting against this pattern.
Alert on any execution of /bin/sh -c by the Director service account that includes command substitution or chaining operators.
Track release upload frequency and source identity to detect unusual activity from accounts with release upload privileges.

How to Mitigate CVE-2026-41010

Immediate Actions Required

Upgrade BOSH Director to v282.1.12 or later, where the fix removes shell interpretation of the job name.
Restrict release upload permissions to a minimal set of trusted operator accounts and rotate credentials for any account suspected of misuse.
Audit recent release uploads for tarballs containing suspicious job names in release.MF.

Patch Information

The Cloud Foundry project fixed the issue in BOSH Director v282.1.12. Operators should apply the upgrade through their standard BOSH bootstrapping workflow. See the Cloud Foundry Blog Post for release details.

Workarounds

If immediate patching is not possible, disable release uploads from non-administrative users until the Director is upgraded.
Place a validating proxy or pre-upload hook in front of the Director that rejects release tarballs whose release.MF job names contain characters outside [A-Za-z0-9_-].
Run the BOSH Director under a least-privileged service account with restrictive filesystem and network controls to limit blast radius if exploitation occurs.

bash

# Example pre-upload validation of release.MF job names
tar -xOf release.tgz release.MF | \
  awk '/^- name:/ {gsub(/"/,"",$3); if ($3 !~ /^[A-Za-z0-9_-]+$/) {print "Invalid job name:", $3; exit 1}}'