Local Blobstore Issues in BOSH Director by Cloud Foundry

CVE-2026-41009

What is CVE-2026-41009?

A vulnerability exists within Cloud Foundry's BOSH Director where improper handling of agent replies during long-running requests can lead to arbitrary file reads and deletes in the local blobstore. The system's failure to normalize file paths allows attackers to access sensitive configuration files outside the designated blobstore root by manipulating request parameters. This could result in unauthorized access to crucial system data, emphasizing the importance of applying the recommended security patches.

References