CVE-2026-41704
Severity CVSS v4.0:
MEDIUM
Type:
CWE-284
Improper Access Control
Publication date:
27/05/2026
Last modified:
08/06/2026
Description
AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response[&#39;value&#39;][&#39;result&#39;][&#39;compile_log_id&#39;] (line 332-338) and passes it to download_and_delete_blob. Separately, any response containing &#39;exception&#39; goes through format_exception (lines 308-325), which reads exception[&#39;blobstore_id&#39;] and also calls download_and_delete_blob. That helper (lines 344-349) calls ResourceManager#get_resource(blob_id) and, in an ensure block, ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix.<br />
<br />
Affected versions:<br />
BOSH Director: All versions prior to v282.1.12
Impact
Base Score 4.0
6.80
Severity 4.0
MEDIUM
Base Score 3.x
5.00
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:cloud_foundry:bosh:*:*:*:*:*:*:*:* | 282.1.12 (excluding) |
To consult the complete list of CPE names with products and versions, see this page