CVE-2026-41011 Overview
CVE-2026-41011 is a command injection vulnerability [CWE-78] in the BOSH Director's PackagePersister.validate_tgz method. The flaw allows an attacker who can upload a release tarball to inject arbitrary shell commands through a crafted name field in the release.MF manifest. The vulnerable code constructs a tar -tf shell command using string interpolation and passes it to Bosh::Common::Exec.sh, which executes through /bin/sh -c without applying Shellwords.escape. Sequel model validation (VALID_ID = /^[-0-9A-Za-z_+.]+$/i) would reject malicious names, but the shell invocation in save_package_source_blob runs before package.save, so validation triggers too late to block exploitation.
Critical Impact
Authenticated users with release upload privileges can execute arbitrary commands on the BOSH Director host, leading to full compromise of the deployment control plane.
Affected Products
- BOSH Director — all versions prior to v282.1.12
- Cloud Foundry deployments relying on vulnerable BOSH releases
- Any platform using PackagePersister.validate_tgz from the affected codebase
Discovery Timeline
- 2026-06-04 - CVE-2026-41011 published to NVD
- 2026-06-04 - Last updated in NVD database
Technical Details for CVE-2026-41011
Vulnerability Analysis
The vulnerability resides in PackagePersister.validate_tgz, which builds a shell command string of the form tar -tf #{tgz} 2>&1. The tgz path is constructed with File.join(release_dir, 'packages', "#{name}.tgz"), where name originates from the package_meta['name'] field inside the uploaded release manifest. Because the resulting string is executed via Ruby's %x{} operator backed by /bin/sh -c, any shell metacharacters in name are interpreted by the shell.
Attackers supply a release archive whose release.MF contains a package name with embedded shell syntax, such as backticks, $(), or ;. When the Director processes the upload, the unsanitized name is concatenated into the command and executed with the privileges of the BOSH Director process. Successful exploitation grants command execution on the Director host, which controls deployments, credentials, and stemcells across the managed environment.
Root Cause
Two defects combine to produce the vulnerability. First, validate_tgz performs no input sanitization and skips Shellwords.escape before interpolating untrusted data into a shell command. Second, in create_package (lines 74–79), save_package_source_blob invokes the shell command before package.save runs the Sequel VALID_ID regex validation. The ordering allows a malicious name to reach the shell even though the data model would later reject it.
Attack Vector
An authenticated user with the ability to upload a release tarball crafts a malformed archive. The release.MF manifest specifies a package name value containing shell metacharacters. When the BOSH Director ingests the release, the injected payload executes under /bin/sh -c on the Director host. No interaction with other users is required, and the operation completes during normal release upload processing.
No verified public proof-of-concept code is available. See the Cloud Foundry Blog Analysis for full technical details.
Detection Methods for CVE-2026-41011
Indicators of Compromise
- Unexpected child processes spawned by the BOSH Director Ruby process, particularly /bin/sh -c invocations containing shell metacharacters in tar -tf arguments.
- Release uploads where release.MF contains package name values with characters outside [-0-9A-Za-z_+.].
- Outbound network connections, file modifications, or new user accounts on the Director host coinciding with release upload events.
Detection Strategies
- Inspect Director audit logs for release uploads and correlate timestamps with shell process creation events on the host.
- Parse uploaded release.MF files and alert when package names fail the VALID_ID = /^[-0-9A-Za-z_+.]+$/i regex.
- Monitor process execution telemetry for tar commands whose arguments include ;, |, `, $(, or newline characters.
Monitoring Recommendations
- Forward BOSH Director process and audit logs to a centralized analytics platform for correlation.
- Alert on any /bin/sh -c execution whose parent is the Director Ruby process and whose command line references a packages directory.
- Track which authenticated principals perform release uploads and baseline normal upload patterns.
How to Mitigate CVE-2026-41011
Immediate Actions Required
- Upgrade BOSH Director to v282.1.12 or later, which contains the fix for PackagePersister.validate_tgz.
- Restrict release upload permissions to a minimal set of trusted operators until the patch is applied.
- Review recent release uploads for package names containing shell metacharacters and investigate the originating host for compromise.
Patch Information
The issue is fixed in BOSH v282.1.12. Refer to the Cloud Foundry Blog Analysis for the upstream advisory and patch references. The fix applies proper shell escaping and ensures model validation occurs before any shell invocation.
Workarounds
- Block release uploads at the API gateway or reverse proxy layer for non-essential users until the Director is upgraded.
- Implement a pre-upload validation script that parses release.MF and rejects archives whose package name fields violate the VALID_ID pattern.
- Run the BOSH Director under a least-privileged account and restrict its outbound network access to limit blast radius if command execution occurs.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
