CVE-2026-41009
Path Traversal in BOSH Director
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vmware | bosh_director | to 282.1.12 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41009 is a medium-severity vulnerability in the Cloud Foundry BOSH Director when it is configured with a local blobstore. The issue occurs because the director processes long-running requests, such as compile_package tasks, where the agent's reply JSON contains fields like compile_log_id and blobstore_id that are passed directly to blobstore operations without any sanitization or normalization.
This lack of validation allows directory traversal attacks, where an attacker can use sequences like "../../" to access files outside the intended blobstore directory. Essentially, an attacker who can control the agent's response (for example, by having root access on a managed VM or publishing to the agent's NATS reply subject) can cause the director to read or delete arbitrary files on the system.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized reading and deletion of arbitrary files on the system where the BOSH Director is running. An attacker could exfiltrate sensitive files such as configuration files (e.g., director.yml) or delete critical files, which could potentially brick the director and disrupt operations.
The attacker needs to have control over the agent's response, which typically requires root access on a managed VM or the ability to publish to the agent's NATS reply subject.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring task logs for unusual file access patterns, especially those involving unexpected file paths or directory traversal sequences like "../../".
Since the vulnerability involves the director processing agent reply JSON containing unvalidated paths, reviewing logs related to compile_package tasks or other long-running requests may reveal suspicious activity.
Network detection could involve monitoring NATS messaging topics for unauthorized publishing to the agent's reply subjects.
- Check BOSH Director task logs for entries referencing file paths outside the blobstore directory, e.g., using grep:
- grep -r '\.\./' /var/vcap/store/jobs/director/logs/
- Monitor NATS topics for unusual publishing activity to agent reply subjects.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade the BOSH Director to version v282.1.12 or later, where this vulnerability is fixed.
Additional immediate steps include implementing network segmentation to limit access to the director and restricting permissions on NATS topics to prevent unauthorized publishing to agent reply subjects.
Monitoring task logs for unusual file access patterns can help detect exploitation attempts and should be part of ongoing mitigation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-41009 allows an attacker with control over a managed VM's agent responses to read or delete arbitrary files on the system by exploiting directory traversal in the local blobstore. This can lead to unauthorized access to sensitive files, such as configuration files, which may contain personal or confidential information.
Such unauthorized access and potential data manipulation can result in violations of data protection regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and mandate the protection of personal and health information.
Therefore, if exploited, this vulnerability could compromise compliance by exposing or destroying regulated data, undermining confidentiality, integrity, and availability requirements stipulated by these standards.