CVE-2026-47826: BOSH CLI Path Traversal Vulnerability

CVE-2026-47826 Overview

CVE-2026-47826 is a path traversal vulnerability in the BOSH Command Line Interface (CLI) tool used by Cloud Foundry. The flaw resides in how the CLI parses path keys within the blobs.yml manifest file. An attacker who supplies a crafted blobs.yml can write arbitrary files to locations outside the intended blob directory and exfiltrate sensitive information from the host running the CLI. The issue affects BOSH CLI tool versions prior to v7.10.4. Exploitation requires user interaction, typically a developer or operator invoking the CLI against attacker-controlled release contents.

Critical Impact
Arbitrary file write and sensitive information disclosure through crafted blobs.yml path keys processed by the BOSH CLI.

Affected Products

BOSH CLI tool versions prior to v7.10.4
Cloud Foundry deployments using vulnerable BOSH CLI releases
Developer and operator workstations running the BOSH CLI

Discovery Timeline

2026-07-09 - CVE-2026-47826 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-47826

Vulnerability Analysis

BOSH is the release engineering, deployment, and lifecycle management tool for Cloud Foundry. The CLI processes release definitions that include a blobs.yml manifest describing binary blobs used during builds. The manifest maps path keys to blob metadata. The CLI joins those path keys with a base blob directory without normalizing or validating that the resulting path stays within that directory.

An attacker crafts a blobs.yml where path keys contain traversal sequences such as ../ or absolute path components. When a victim runs a CLI command that materializes the blob contents, the CLI resolves the traversal and writes files to arbitrary locations. The same parsing behavior enables reading files outside the blob directory, allowing sensitive data such as SSH keys, cloud credentials, or configuration files to be included in later operations. The vulnerability aligns with [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is missing input validation on path key entries inside blobs.yml. The CLI trusts the manifest content and concatenates keys with the destination directory. There is no canonicalization step that rejects paths escaping the intended base directory.

Attack Vector

The attack is network-reachable because release contents are typically distributed through Git repositories or artifact stores. An attacker publishes a malicious release or submits a pull request containing a poisoned blobs.yml. When an operator clones the release and runs a BOSH CLI command that reads or syncs blobs, the traversal executes with the user's privileges. User interaction is required for exploitation.

// Conceptual illustration - see the Cloud Foundry advisory for technical details
// blobs.yml entry with traversing path key:
//   "../../../etc/attacker-controlled-file":
//     size: 42
//     object_id: <blob-id>
//     sha: <hash>
// Result: CLI writes blob contents to /etc/attacker-controlled-file

See the Cloud Foundry advisory for the full technical description.

Detection Methods for CVE-2026-47826

Indicators of Compromise

Entries in blobs.yml containing ../, ..\, or absolute paths as key names
Unexpected file writes outside the release blobs/ directory during BOSH CLI invocations
Modifications to sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or CI runner configuration after BOSH CLI runs
BOSH CLI processes accessing paths unrelated to the current release working directory

Detection Strategies

Inspect all blobs.yml files across release repositories for path keys containing traversal characters or leading /
Audit CI/CD logs for BOSH CLI executions where file system writes occurred outside the workspace
Enforce file integrity monitoring on developer workstations and pipeline runners that execute the BOSH CLI

Monitoring Recommendations

Log the version of the BOSH CLI used in every pipeline run and alert on versions prior to v7.10.4
Monitor process telemetry for bosh CLI child processes writing to directories outside the release working tree
Track pull requests that add or modify blobs.yml entries for suspicious path key changes

How to Mitigate CVE-2026-47826

Immediate Actions Required

Upgrade the BOSH CLI to version v7.10.4 or later on all workstations, bastions, and CI/CD runners
Review recent BOSH release repositories for malicious blobs.yml entries before running CLI operations
Restrict who can modify release repositories and enforce code review on blobs.yml changes

Patch Information

The fix is delivered in BOSH CLI v7.10.4. The patched CLI validates path keys in blobs.yml and rejects entries that resolve outside the blob directory. Refer to the Cloud Foundry advisory for release notes and download locations.

Workarounds

Run the BOSH CLI inside an ephemeral, unprivileged container or sandbox to contain arbitrary writes
Pre-scan blobs.yml files with a script that rejects keys containing .., absolute paths, or non-relative components
Avoid executing BOSH CLI commands against untrusted third-party releases until the CLI is upgraded

bash

# Verify installed BOSH CLI version and upgrade if below v7.10.4
bosh --version

# Simple guard to reject traversing keys before running CLI operations
grep -E '^(\s*["'\'']?)(\.\.|/)' config/blobs.yml && \
  echo "Unsafe path key detected in blobs.yml" && exit 1