Path Traversal Vulnerability in BOSH Agent by Cloud Foundry

CVE-2026-41861

What is CVE-2026-41861?

The BOSH Agent by Cloud Foundry is susceptible to a path traversal vulnerability that allows an attacker with IaaS-metadata access to exploit the system. This vulnerability enables the attacker to manipulate the agent into writing a root-owned file to any specified path ending in .network. Furthermore, the attacker can create any necessary parent directories with permissions set to 0777, facilitating significant security risks on Ubuntu environments.

References