Arbitrary Blobstore Deletion Risk in BOSH Director by Cloud Foundry

CVE-2026-41704

What is CVE-2026-41704?

The vulnerability arises from how the AgentClient handles NATS replies. It processes every response, calling 'inject_compile_log' on each one, and retrieves the 'compile_log_id' for resource deletion. Furthermore, any response with 'exception' triggers the 'format_exception' function, which reads an exception ID and also initiates the blob deletion process. The method used to delete resources does not implement checks for ownership or proper identifier format, creating a critical loophole where compromised VMs can execute arbitrary deletions from the shared blobstore in BOSH Director.

References