CVE-2026-41009 Cloud Foundry Foundation CVE debrief

Who should care

Organizations running BOSH Director with local blobstore configuration, particularly Cloud Foundry platform operators and teams managing multi-tenant BOSH environments where agent compromise or malicious agent deployment is a concern

Technical summary

The vulnerability exists in the interaction between AgentClient and the local blobstore implementation. When the director processes agent responses for long-running tasks, methods inject_compile_log (lines 332-339) and format_exception (lines 318-325) extract blob identifiers from agent-controlled JSON fields (response['value']['result']['compile_log_id'] and exception['blobstore_id']). These identifiers pass through download_and_delete_blob (lines 344-349) to Api::ResourceManager, which forwards them directly to the blobstore layer. In Blobstore::LocalClient, the object_file_path method (local_client.rb:54-56) implements path construction as File.join(@blobstore_path, oid) without sanitization or normalization. An attacker controlling a BOSH agent can supply a malicious oid value containing directory traversal sequences (e.g., ../../jobs/director/config/director.yml) to access or delete files outside the intended blobstore directory. The ensure block in download_and_delete_blob guarantees deletion occurs even if read operations fail, enabling both information disclosure and integrity impact.

Defensive priority

medium

Recommended defensive actions

• Upgrade BOSH Director to v282.1.12 or later
• If immediate patching is not feasible, avoid using the local blobstore provider; migrate to an external blobstore backend (e.g., S3, GCS, or Azure Blob Storage)
• Review director host filesystem permissions to limit blast radius of potential file access
• Monitor director logs for anomalous blob access patterns involving path-like identifiers
• Audit agent certificates and authentication to ensure only authorized agents can communicate with the director

Evidence notes

Vulnerability description confirms path traversal via unnormalized oid parameter in Blobstore::LocalClient#object_file_path. CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/UI:P/VC:N/VI:H/VA:L) reflects local attack vector with high privileges required. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) assigned by VMware security team.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.