TI-2026-29660 Aliases CVE-2026-41009 GHSA-gq7j-4834-ccgp

Local Blobstore may allow arbitrary reads/deletes

LOW 19CWE-22Published 2026-05-27 · Updated 2026-05-27

Key facts

Attack vector: Local
Privileges required: High
User interaction: Passive
Attack complexity: High
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 332-339) reads response['value']['result']['compile_log_id'] and format_exception (line 318-325) reads exception['blobstore_id']; both pass the agent-supplied string unmodified to download_and_delete_blob(blob_id) (line 344-349), which calls @resource_manager.get_resource(blob_id) and, in an ensure block, @resource_manager.delete_resource(blob_id). Api::ResourceManager forwards the id straight to blobstore.get(id) / blobstore.delete(id). When the director is configured with the local blobstore provider, Blobstore::LocalClient#object_file_path(oid) is File.join(@blobstore_path, oid) (local_client.rb:54-56) with no normalisation, so oid = "../../jobs/director/config/director.yml" resolves outside the blobstore root. Affected versions: BOSH Director: All versions prior to v282.1.12

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00099 0th percentileScored 2026-11-07

Fix Fixed BOSH Director (Cloud Foundry Foundation): 282.1.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cloud Foundry Foundation	BOSH Director	before 282.1.12	282.1.12	Patch available	CNA

BOSH Director VendorCloud Foundry Foundation Affected before 282.1.12 Fixed in 282.1.12 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cloud_foundry:bosh::::::::	before 282.1.12	Vulnerable	Cloud Foundry

cpe:2.3:a:cloud_foundry:bosh:*:*:*:*:*:*:*:* Versions before 282.1.12 Vulnerable ·Cloud Foundry

Remediation

Fix · CNA BOSH Director (Cloud Foundry Foundation) Fixed in 282.1.12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-05-27
Cloud Foundry Foundation BOSH Director 282.1.12
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-30220 Compromised VM can make arbitrary blobstore deletesPriority LOW 29
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-41009
2026-10-03 Alias added: GHSA-gq7j-4834-ccgp

References

Advisory 1

https://www.cloudfoundry.org/blog/cve-2026-41009-local-blobstore-may-allow-arbitrary-reads-deletes/

TI-2026-29616 Information disclosure in Cloud Foundry Foundation uaa_release CVSS 4.0CRITICAL 10.0
TI-2026-35291 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin CVSS 4.0CRITICAL 9.2
TI-2026-29615 Improper authentication in Cloud Foundry Foundation log-cache_release CVSS 3.1HIGH 7.5
TI-2026-35283 Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite CVSS 4.0HIGH 8.5
TI-2026-35280 CVE-2026-47827 – BOSH CLI Powershell Injection CVSS 3.1HIGH 7.5
TI-2026-29662 OS command injection in Cloud Foundry Foundation BOSH CVSS 4.0HIGH 8.7

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences