CVE-2026-41704

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-41704
AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any response containing 'exception' goes through format_exception (lines 308-325), which reads exception['blobstore_id'] and also calls download_and_delete_blob. That helper (lines 344-349) calls ResourceManager#get_resource(blob_id) and, in an ensure block, ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix. Affected versions: BOSH Director: All versions prior to v282.1.12

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.6 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.cloudfoundry.org/blog/cve-2026-41704-compromised-vm-can-make-arbitrary-blobstore-deletes/ Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cloud_foundry:bosh:*:*:*:*:*:*:*:*
History

26 Oct 2026, 11:10

Type Values Removed Values Added
Summary
  • (es) AgentClient#handle_method (líneas 264-303) procesa cada respuesta de NATS. Llama a inject_compile_log (línea 273) en cada respuesta, que lee response[’value’][’result’][’compile_log_id’] (líneas 332-338) y lo pasa a download_and_delete_blob. Por separado, cualquier respuesta que contenga ’exception’ pasa por format_exception (líneas 308-325), que lee exception[’blobstore_id’] y también llama a download_and_delete_blob. Esa función auxiliar (líneas 344-349) llama a ResourceManager#get_resource(blob_id) y, en un bloque ensure, a ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) llama a blobstore.delete(id) en el único blobstore compartido del Director sin verificación de formato UUID, sin verificación de propiedad y sin prefijo de espacio de nombres. Versiones afectadas: BOSH Director: Todas las versiones anteriores a la v282.1.12
Information

Published : 2026-05-27 08:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-41704

Mitre link : CVE-2026-41704

CVE.ORG link : CVE-2026-41704

JSON object : View

Products Affected

cloud_foundry

  • bosh
CWE
CWE-284

Improper Access Control