CVE-2026-41009 in BOSH Director
Summary
by MITRE • 05/27/2026
When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 332-339) reads response['value']['result']['compile_log_id'] and format_exception (line 318-325) reads exception['blobstore_id']; both pass the agent-supplied string unmodified to download_and_delete_blob(blob_id) (line 344-349), which calls @resource_manager.get_resource(blob_id) and, in an ensure block, @resource_manager.delete_resource(blob_id). Api::ResourceManager forwards the id straight to blobstore.get(id) / blobstore.delete(id). When the director is configured with the local blobstore provider, Blobstore::LocalClient#object_file_path(oid) is File.join(@blobstore_path, oid) (local_client.rb:54-56) with no normalisation, so oid = "../../jobs/director/config/director.yml" resolves outside the blobstore root.
Affected versions: BOSH Director: All versions prior to v282.1.12
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/27/2026
This vulnerability represents a critical path traversal flaw in the BOSH Director component that allows remote attackers to access arbitrary files on the director's filesystem through improper input validation in the blobstore handling logic. The vulnerability occurs when processing long-running requests such as compile_package where the director's response contains blob identifiers that are directly passed to the blobstore operations without proper sanitization or normalization. The attack exploits the lack of path validation in the local blobstore provider implementation where the blob identifier is used directly in File.join operations without any normalization or validation against the intended blobstore root directory.
The technical execution involves the AgentClient component reading compile_log_id and blobstore_id values from the agent's JSON response without sanitizing these inputs before passing them to the download_and_delete_blob method. This method then forwards these unvalidated identifiers directly to the ResourceManager which passes them unchanged to the blobstore implementation. In the case of local blobstore configuration, the Blobstore::LocalClient performs a straightforward file path construction using File.join(@blobstore_path, oid) without any path normalization or validation, creating a classic path traversal condition where maliciously crafted blob identifiers can reference files outside the intended blobstore directory structure.
The operational impact of this vulnerability is severe as it allows an authenticated attacker to potentially read sensitive configuration files, credentials, or other system files accessible to the director process. The specific example demonstrates how a blob identifier such as "../../jobs/director/config/director.yml" could traverse up the directory structure and access critical configuration files that contain sensitive information. This vulnerability affects all versions prior to v282.1.12 and represents a direct violation of input validation principles that would typically be addressed through CWE-22 Path Traversal vulnerabilities. The flaw demonstrates poor security practices in handling user-supplied data in file system operations and represents a significant risk to systems where BOSH Director is deployed with local blobstore providers.
The mitigation strategy involves implementing proper input validation and normalization of blob identifiers before they are used in file system operations. This includes ensuring that all blob identifiers are validated against the expected blobstore root directory, normalizing paths to prevent directory traversal, and implementing proper access controls for blobstore operations. Organizations should upgrade to BOSH Director version 282.1.12 or later where this vulnerability has been addressed through proper path validation in the blobstore implementation. Additionally, security practitioners should consider implementing network segmentation, limiting the exposure of the director service, and monitoring for anomalous blobstore access patterns that could indicate exploitation attempts. The vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter and T1566 Phishing, as it enables attackers to gain access to sensitive files that could be used for further exploitation or privilege escalation within the BOSH environment.