Executive brief
BOSH Director, a tool used for deploying and managing cloud software, contains a vulnerability that allows a compromised virtual machine to delete data from shared storage. If an attacker gains control of a single VM within a deployment, they can trick the central management system into deleting critical files or configuration data. This could lead to service disruptions or the loss of important deployment assets across the entire environment.
Technical details
An improper access control vulnerability exists in BOSH Director's AgentClient#handle_method. The component processes NATS replies from agents and calls download_and_delete_blob on IDs provided in the 'compile_log_id' or 'blobstore_id' fields without performing UUID format checks, ownership verification, or namespace validation. An attacker with root access on a deployed VM can craft malicious responses to routine Director requests (like ping or get_state) to trigger the deletion of arbitrary blobs from the shared S3, DAV, or GCS bucket. In configurations using a local blobstore, this can be further exploited via path traversal to read and delete local system files on the Director. The issue is resolved in BOSH Director version v282.1.12.
Affected products
- Cloud Foundry Foundation BOSH Director All versions prior to v282.1.12
Timeline
- 2026-05-26: advisory: Cloud Foundry Foundation published the security advisory.
- 2026-05-27: disclosed: CVE-2026-41704 published to the NVD.