Compromised VM can make arbitrary blobstore deletes
AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any response containing 'exception' goes through format_exception (lines 308-325), which reads exception['blobstore_id'] and also calls download_and_delete_blob. That helper (lines 344-349) calls ResourceManager#get_resource(blob_id) and, in an ensure block, ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix. Affected versions: BOSH Director: All versions prior to v282.1.12
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-41704
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 23:53 UTC · Revision 1
Source evidence
Compromised VM can make arbitrary blobstore deletes
core-osv · Original sourcePublished 27 May 2026, 07:13 UTC
AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any response containing 'exception' goes through format_exception (lines 308-325), which reads exception['blobstore_id'] and also calls download_and_delete_blob. That helper (lines 344-349) calls ResourceManager#get_resource(blob_id) and, in an ensure block, ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix. Affected versions: BOSH Director: All versions prior to v282.1.12
osv:CVE-2026-41704
Complete source record
{
"id": "1012407e59939bce6bf87493aa47cf7378441f18b0028d6181b51444693ebe74",
"url": "https://osv.dev/vulnerability/CVE-2026-41704",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Compromised VM can make arbitrary blobstore deletes",
"summary": "AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any response containing 'exception' goes through format_exception (lines 308-325), which reads exception['blobstore_id'] and also calls download_and_delete_blob. That helper (lines 344-349) calls ResourceManager#get_resource(blob_id) and, in an ensure block, ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix. Affected versions: BOSH Director: All versions prior to v282.1.12",
"evidence": "osv:CVE-2026-41704",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-41704",
"aliases": [
"CVE-2026-41704"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/cloudfoundry/bosh",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "86ee55839a6ee2ffa73e20dfe1e7622f6f91e3f6"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:cloud_foundry:bosh:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "282.1.12"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v282.1.11",
"v282.1.10",
"v282.1.9",
"v282.1.8",
"v282.1.7",
"v282.1.6",
"v282.1.5",
"v282.1.4",
"v282.1.3",
"v282.1.2",
"v282.1.1",
"v282.1.0",
"v282.0.10",
"v282.0.9",
"v282.0.8",
"v282.0.7",
"v282.0.6",
"v282.0.5",
"v282.0.4",
"v282.0.3",
"v282.0.2",
"v282.0.1",
"v282.0.0",
"v281.0.1",
"v281.0.0",
"v280.1.22",
"v280.1.21",
"v280.1.20",
"v280.1.19",
"v280.1.18",
"v280.1.17",
"v280.1.16",
"v280.1.15",
"v280.1.14",
"v280.1.13",
"v280.1.12",
"v280.1.11",
"v280.1.10",
"v280.1.9",
"v280.1.8",
"v280.1.7",
"v280.1.6",
"v280.1.5",
"v280.1.4",
"v280.1.3",
"v280.1.2",
"v280.1.1",
"v280.1.0",
"v280.0.25",
"v280.0.24",
"v280.0.23",
"v280.0.22",
"v280.0.21",
"v280.0.20",
"v280.0.19",
"v280.0.18",
"v280.0.17",
"v280.0.16",
"v280.0.15",
"v280.0.14",
"v280.0.13",
"v280.0.12",
"v280.0.11",
"v280.0.10",
"v280.0.9",
"v280.0.8",
"v280.0.7",
"v280.0.6",
"v280.0.5",
"v280.0.4",
"v280.0.3",
"v280.0.2",
"v280.0.1",
"v280.0.0",
"v279.0.0",
"v278.0.0",
"v277.4.3",
"v277.4.2",
"v277.4.1",
"v277.4.0",
"v277.3.3",
"v277.3.2",
"v277.3.1",
"v277.3.0",
"v277.2.0",
"v277.1.0",
"v277.0.0",
"v276.1.1",
"v276.1.0",
"v276.0.0",
"v275.1.0",
"v275.0.0",
"v274.4.0",
"v274.3.0",
"v274.2.0",
"v274.1.0",
"v274.0.0",
"v273.1.0",
"v273.0.0",
"v272.6.0",
"v272.5.0",
"v272.4.0",
"v272.3.0",
"v272.2.0",
"v272.1.0",
"v272.0.0",
"v271.20.0",
"v271.19.0",
"v271.18.0",
"v271.17.0",
"v271.16.0",
"v271.15.0",
"v271.14.0",
"v271.13.0",
"v271.12.0",
"v271.11.0",
"v271.10.0",
"v271.9.0",
"v271.8.0",
"v271.7.0",
"v271.6.0",
"v271.5.0",
"v271.4.0",
"v271.3.0",
"v271.2.0",
"v271.1.0",
"v271.0.0",
"v270.12.0",
"v270.11.0",
"v270.10.0",
"v270.9.0",
"v270.8.0",
"v270.7.0",
"v270.6.0",
"v270.5.0",
"v270.4.0",
"v270.3.0",
"v270.2.0",
"v270.1.1",
"v270.1.0",
"v270.0.0",
"v269.0.0",
"v268.7.0",
"v268.6.0",
"v268.5.0",
"v268.4.0",
"v268.2.1",
"v268.3.0",
"v264.1",
"v261.2",
"scotty_09012012"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41704.json"
}
}
],
"modified": "2026-10-28T02:30:40.363674040Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41704.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-41704",
"https://www.cloudfoundry.org/blog/cve-2026-41704-compromised-vm-can-make-arbitrary-blobstore-deletes/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-284"
],
"cna_assigner": "vmware",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "282.1.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41704.json"
}
},
"related_cves": [
{
"value": "CVE-2026-41704",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508170,
"published_at": "2026-05-27T07:13:15.525+00:00"
}