{"id":"CVE-2026-41704","summary":"Compromised VM can make arbitrary blobstore deletes","details":"AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any response containing 'exception' goes through format_exception (lines 308-325), which reads exception['blobstore_id'] and also calls download_and_delete_blob. That helper (lines 344-349) calls ResourceManager#get_resource(blob_id) and, in an ensure block, ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix.\n\nAffected versions:\nBOSH Director: All versions prior to v282.1.12","modified":"2026-08-12T03:51:46.451278004Z","published":"2026-05-27T07:13:15.525Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41704.json","unresolved_ranges":[{"extracted_events":[{"fixed":"282.1.12"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"vmware","cwe_ids":["CWE-284"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41704.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41704"},{"type":"ARTICLE","url":"https://www.cloudfoundry.org/blog/cve-2026-41704-compromised-vm-can-make-arbitrary-blobstore-deletes/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/bosh","events":[{"introduced":"0"},{"fixed":"86ee55839a6ee2ffa73e20dfe1e7622f6f91e3f6"}],"database_specific":{"cpe":"cpe:2.3:a:cloud_foundry:bosh:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"282.1.12"}],"source":"CPE_RANGE"}}],"versions":["v282.1.11","v282.1.10","v282.1.9","v282.1.8","v282.1.7","v282.1.6","v282.1.5","v282.1.4","v282.1.3","v282.1.2","v282.1.1","v282.1.0","v282.0.10","v282.0.9","v282.0.8","v282.0.7","v282.0.6","v282.0.5","v282.0.4","v282.0.3","v282.0.2","v282.0.1","v282.0.0","v281.0.1","v281.0.0","v280.1.22","v280.1.21","v280.1.20","v280.1.19","v280.1.18","v280.1.17","v280.1.16","v280.1.15","v280.1.14","v280.1.13","v280.1.12","v280.1.11","v280.1.10","v280.1.9","v280.1.8","v280.1.7","v280.1.6","v280.1.5","v280.1.4","v280.1.3","v280.1.2","v280.1.1","v280.1.0","v280.0.25","v280.0.24","v280.0.23","v280.0.22","v280.0.21","v280.0.20","v280.0.19","v280.0.18","v280.0.17","v280.0.16","v280.0.15","v280.0.14","v280.0.13","v280.0.12","v280.0.11","v280.0.10","v280.0.9","v280.0.8","v280.0.7","v280.0.6","v280.0.5","v280.0.4","v280.0.3","v280.0.2","v280.0.1","v280.0.0","v279.0.0","v278.0.0","v277.4.3","v277.4.2","v277.4.1","v277.4.0","v277.3.3","v277.3.2","v277.3.1","v277.3.0","v277.2.0","v277.1.0","v277.0.0","v276.1.1","v276.1.0","v276.0.0","v275.1.0","v275.0.0","v274.4.0","v274.3.0","v274.2.0","v274.1.0","v274.0.0","v273.1.0","v273.0.0","v272.6.0","v272.5.0","v272.4.0","v272.3.0","v272.2.0","v272.1.0","v272.0.0","v271.20.0","v271.19.0","v271.18.0","v271.17.0","v271.16.0","v271.15.0","v271.14.0","v271.13.0","v271.12.0","v271.11.0","v271.10.0","v271.9.0","v271.8.0","v271.7.0","v271.6.0","v271.5.0","v271.4.0","v271.3.0","v271.2.0","v271.1.0","v271.0.0","v270.12.0","v270.11.0","v270.10.0","v270.9.0","v270.8.0","v270.7.0","v270.6.0","v270.5.0","v270.4.0","v270.3.0","v270.2.0","v270.1.1","v270.1.0","v270.0.0","v269.0.0","v268.7.0","v268.6.0","v268.5.0","v268.4.0","v268.2.1","v268.3.0","v264.1","v261.2","scotty_09012012"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41704.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:H"}]}