Vulnerability Details CVE-2026-41704
AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any response containing 'exception' goes through format_exception (lines 308-325), which reads exception['blobstore_id'] and also calls download_and_delete_blob. That helper (lines 344-349) calls ResourceManager#get_resource(blob_id) and, in an ensure block, ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix.
Affected versions:
BOSH Director: All versions prior to v282.1.12
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 1.6%
CVSS Severity
CVSS v3 Score 5.0
Products affected by CVE-2026-41704
-
cpe:2.3:a:cloud_foundry:bosh:258
-
cpe:2.3:a:cloud_foundry:bosh:259
-
cpe:2.3:a:cloud_foundry:bosh:260
-
cpe:2.3:a:cloud_foundry:bosh:260.1
-
cpe:2.3:a:cloud_foundry:bosh:260.2
-
cpe:2.3:a:cloud_foundry:bosh:260.3
-
cpe:2.3:a:cloud_foundry:bosh:260.4
-
cpe:2.3:a:cloud_foundry:bosh:260.5
-
cpe:2.3:a:cloud_foundry:bosh:260.6
-
cpe:2.3:a:cloud_foundry:bosh:261
-
cpe:2.3:a:cloud_foundry:bosh:261.1
-
cpe:2.3:a:cloud_foundry:bosh:261.2
-
cpe:2.3:a:cloud_foundry:bosh:261.3
-
cpe:2.3:a:cloud_foundry:bosh:261.4
-
cpe:2.3:a:cloud_foundry:bosh:262
-
cpe:2.3:a:cloud_foundry:bosh:262.1
-
cpe:2.3:a:cloud_foundry:bosh:262.2
-
cpe:2.3:a:cloud_foundry:bosh:262.3
-
cpe:2.3:a:cloud_foundry:bosh:262.5.0
-
cpe:2.3:a:cloud_foundry:bosh:262.8.0
-
cpe:2.3:a:cloud_foundry:bosh:263
-
cpe:2.3:a:cloud_foundry:bosh:263.1.0
-
cpe:2.3:a:cloud_foundry:bosh:263.10.0
-
cpe:2.3:a:cloud_foundry:bosh:263.12.0
-
cpe:2.3:a:cloud_foundry:bosh:263.2.0
-
cpe:2.3:a:cloud_foundry:bosh:263.3.0
-
cpe:2.3:a:cloud_foundry:bosh:263.4.0
-
cpe:2.3:a:cloud_foundry:bosh:263.5.0
-
cpe:2.3:a:cloud_foundry:bosh:263.9.0
-
cpe:2.3:a:cloud_foundry:bosh:264.1
-
cpe:2.3:a:cloud_foundry:bosh:264.10.0
-
cpe:2.3:a:cloud_foundry:bosh:264.11.0
-
cpe:2.3:a:cloud_foundry:bosh:264.12.0
-
cpe:2.3:a:cloud_foundry:bosh:264.14.0
-
cpe:2.3:a:cloud_foundry:bosh:264.15.0
-
cpe:2.3:a:cloud_foundry:bosh:264.17.0
-
cpe:2.3:a:cloud_foundry:bosh:264.2.0
-
cpe:2.3:a:cloud_foundry:bosh:264.3.0
-
cpe:2.3:a:cloud_foundry:bosh:264.4.0
-
cpe:2.3:a:cloud_foundry:bosh:264.5.0
-
cpe:2.3:a:cloud_foundry:bosh:264.6.0
-
cpe:2.3:a:cloud_foundry:bosh:264.7.0
-
cpe:2.3:a:cloud_foundry:bosh:264.8.0
-
cpe:2.3:a:cloud_foundry:bosh:264.9.0
-
cpe:2.3:a:cloud_foundry:bosh:265.1.0
-
cpe:2.3:a:cloud_foundry:bosh:265.10.0
-
cpe:2.3:a:cloud_foundry:bosh:265.11.0
-
cpe:2.3:a:cloud_foundry:bosh:265.2.0
-
cpe:2.3:a:cloud_foundry:bosh:265.3.0
-
cpe:2.3:a:cloud_foundry:bosh:265.4.0
-
cpe:2.3:a:cloud_foundry:bosh:265.6.0
-
cpe:2.3:a:cloud_foundry:bosh:265.7.0
-
cpe:2.3:a:cloud_foundry:bosh:265.9.0
-
cpe:2.3:a:cloud_foundry:bosh:266.10.0
-
cpe:2.3:a:cloud_foundry:bosh:266.12.0
-
cpe:2.3:a:cloud_foundry:bosh:266.13.0
-
cpe:2.3:a:cloud_foundry:bosh:266.14.0
-
cpe:2.3:a:cloud_foundry:bosh:266.15.0
-
cpe:2.3:a:cloud_foundry:bosh:266.16.0
-
cpe:2.3:a:cloud_foundry:bosh:266.17.0
-
cpe:2.3:a:cloud_foundry:bosh:266.2.0
-
cpe:2.3:a:cloud_foundry:bosh:266.3.0
-
cpe:2.3:a:cloud_foundry:bosh:266.4.0
-
cpe:2.3:a:cloud_foundry:bosh:266.5.0
-
cpe:2.3:a:cloud_foundry:bosh:266.6.0
-
cpe:2.3:a:cloud_foundry:bosh:266.7.0
-
cpe:2.3:a:cloud_foundry:bosh:266.8.0
-
cpe:2.3:a:cloud_foundry:bosh:267.10.0
-
cpe:2.3:a:cloud_foundry:bosh:267.11.0
-
cpe:2.3:a:cloud_foundry:bosh:267.12.0
-
cpe:2.3:a:cloud_foundry:bosh:267.13.0
-
cpe:2.3:a:cloud_foundry:bosh:267.14.0
-
cpe:2.3:a:cloud_foundry:bosh:267.2.0
-
cpe:2.3:a:cloud_foundry:bosh:267.3.0
-
cpe:2.3:a:cloud_foundry:bosh:267.4.0
-
cpe:2.3:a:cloud_foundry:bosh:267.5.0
-
cpe:2.3:a:cloud_foundry:bosh:267.6.0
-
cpe:2.3:a:cloud_foundry:bosh:267.7.0
-
cpe:2.3:a:cloud_foundry:bosh:267.8.0
-
cpe:2.3:a:cloud_foundry:bosh:268.0.1
-
cpe:2.3:a:cloud_foundry:bosh:268.1.0
-
cpe:2.3:a:cloud_foundry:bosh:268.2.0
-
cpe:2.3:a:cloud_foundry:bosh:268.2.1
-
cpe:2.3:a:cloud_foundry:bosh:268.3.0
-
cpe:2.3:a:cloud_foundry:bosh:268.4.0
-
cpe:2.3:a:cloud_foundry:bosh:268.5.0
-
cpe:2.3:a:cloud_foundry:bosh:268.6.0
-
cpe:2.3:a:cloud_foundry:bosh:268.7.0
-
cpe:2.3:a:cloud_foundry:bosh:269.0.0
-
cpe:2.3:a:cloud_foundry:bosh:269.0.1
-
cpe:2.3:a:cloud_foundry:bosh:270.0.0
-
cpe:2.3:a:cloud_foundry:bosh:270.1.0
-
cpe:2.3:a:cloud_foundry:bosh:270.1.1
-
cpe:2.3:a:cloud_foundry:bosh:270.10.0
-
cpe:2.3:a:cloud_foundry:bosh:270.11.0
-
cpe:2.3:a:cloud_foundry:bosh:270.12.0
-
cpe:2.3:a:cloud_foundry:bosh:270.2.0
-
cpe:2.3:a:cloud_foundry:bosh:270.3.0
-
cpe:2.3:a:cloud_foundry:bosh:270.4.0
-
cpe:2.3:a:cloud_foundry:bosh:270.5.0
-
cpe:2.3:a:cloud_foundry:bosh:270.6.0
-
cpe:2.3:a:cloud_foundry:bosh:270.7.0
-
cpe:2.3:a:cloud_foundry:bosh:270.8.0
-
cpe:2.3:a:cloud_foundry:bosh:270.9.0
-
cpe:2.3:a:cloud_foundry:bosh:271.0.0
-
cpe:2.3:a:cloud_foundry:bosh:271.1.0
-
cpe:2.3:a:cloud_foundry:bosh:271.10.0
-
cpe:2.3:a:cloud_foundry:bosh:271.11.0
-
cpe:2.3:a:cloud_foundry:bosh:271.12.0
-
cpe:2.3:a:cloud_foundry:bosh:271.13.0
-
cpe:2.3:a:cloud_foundry:bosh:271.14.0
-
cpe:2.3:a:cloud_foundry:bosh:271.15.0
-
cpe:2.3:a:cloud_foundry:bosh:271.16.0
-
cpe:2.3:a:cloud_foundry:bosh:271.17.0
-
cpe:2.3:a:cloud_foundry:bosh:271.18.0
-
cpe:2.3:a:cloud_foundry:bosh:271.19.0
-
cpe:2.3:a:cloud_foundry:bosh:271.2.0
-
cpe:2.3:a:cloud_foundry:bosh:271.20.0
-
cpe:2.3:a:cloud_foundry:bosh:271.3.0
-
cpe:2.3:a:cloud_foundry:bosh:271.4.0
-
cpe:2.3:a:cloud_foundry:bosh:271.5.0
-
cpe:2.3:a:cloud_foundry:bosh:271.6.0
-
cpe:2.3:a:cloud_foundry:bosh:271.7.0
-
cpe:2.3:a:cloud_foundry:bosh:271.8.0
-
cpe:2.3:a:cloud_foundry:bosh:271.9.0
-
cpe:2.3:a:cloud_foundry:bosh:272.0.0
-
cpe:2.3:a:cloud_foundry:bosh:272.1.0
-
cpe:2.3:a:cloud_foundry:bosh:272.2.0
-
cpe:2.3:a:cloud_foundry:bosh:272.3.0
-
cpe:2.3:a:cloud_foundry:bosh:272.4.0
-
cpe:2.3:a:cloud_foundry:bosh:272.5.0
-
cpe:2.3:a:cloud_foundry:bosh:272.6.0
-
cpe:2.3:a:cloud_foundry:bosh:273.0.0
-
cpe:2.3:a:cloud_foundry:bosh:273.1.0
-
cpe:2.3:a:cloud_foundry:bosh:274.0.0
-
cpe:2.3:a:cloud_foundry:bosh:274.1.0
-
cpe:2.3:a:cloud_foundry:bosh:274.2.0
-
cpe:2.3:a:cloud_foundry:bosh:274.3.0
-
cpe:2.3:a:cloud_foundry:bosh:274.4.0
-
cpe:2.3:a:cloud_foundry:bosh:275.0.0
-
cpe:2.3:a:cloud_foundry:bosh:275.1.0
-
cpe:2.3:a:cloud_foundry:bosh:276.0.0
-
cpe:2.3:a:cloud_foundry:bosh:276.1.0
-
cpe:2.3:a:cloud_foundry:bosh:276.1.1
-
cpe:2.3:a:cloud_foundry:bosh:277.0.0
-
cpe:2.3:a:cloud_foundry:bosh:277.1.0
-
cpe:2.3:a:cloud_foundry:bosh:277.2.0
-
cpe:2.3:a:cloud_foundry:bosh:277.3.0
-
cpe:2.3:a:cloud_foundry:bosh:277.3.1
-
cpe:2.3:a:cloud_foundry:bosh:277.3.2
-
cpe:2.3:a:cloud_foundry:bosh:277.3.3
-
cpe:2.3:a:cloud_foundry:bosh:277.3.4
-
cpe:2.3:a:cloud_foundry:bosh:277.4.0
-
cpe:2.3:a:cloud_foundry:bosh:277.4.1
-
cpe:2.3:a:cloud_foundry:bosh:277.4.2
-
cpe:2.3:a:cloud_foundry:bosh:277.4.3
-
cpe:2.3:a:cloud_foundry:bosh:278.0.0
-
cpe:2.3:a:cloud_foundry:bosh:279.0.0
-
cpe:2.3:a:cloud_foundry:bosh:280.0.0
-
cpe:2.3:a:cloud_foundry:bosh:280.0.1
-
cpe:2.3:a:cloud_foundry:bosh:280.0.10
-
cpe:2.3:a:cloud_foundry:bosh:280.0.11
-
cpe:2.3:a:cloud_foundry:bosh:280.0.12
-
cpe:2.3:a:cloud_foundry:bosh:280.0.13
-
cpe:2.3:a:cloud_foundry:bosh:280.0.14
-
cpe:2.3:a:cloud_foundry:bosh:280.0.15
-
cpe:2.3:a:cloud_foundry:bosh:280.0.16
-
cpe:2.3:a:cloud_foundry:bosh:280.0.17
-
cpe:2.3:a:cloud_foundry:bosh:280.0.18
-
cpe:2.3:a:cloud_foundry:bosh:280.0.19
-
cpe:2.3:a:cloud_foundry:bosh:280.0.2
-
cpe:2.3:a:cloud_foundry:bosh:280.0.20
-
cpe:2.3:a:cloud_foundry:bosh:280.0.21
-
cpe:2.3:a:cloud_foundry:bosh:280.0.22
-
cpe:2.3:a:cloud_foundry:bosh:280.0.23
-
cpe:2.3:a:cloud_foundry:bosh:280.0.24
-
cpe:2.3:a:cloud_foundry:bosh:280.0.25
-
cpe:2.3:a:cloud_foundry:bosh:280.0.3
-
cpe:2.3:a:cloud_foundry:bosh:280.0.4
-
cpe:2.3:a:cloud_foundry:bosh:280.0.5
-
cpe:2.3:a:cloud_foundry:bosh:280.0.6
-
cpe:2.3:a:cloud_foundry:bosh:280.0.7
-
cpe:2.3:a:cloud_foundry:bosh:280.0.8
-
cpe:2.3:a:cloud_foundry:bosh:280.0.9
-
cpe:2.3:a:cloud_foundry:bosh:280.1.0
-
cpe:2.3:a:cloud_foundry:bosh:280.1.1
-
cpe:2.3:a:cloud_foundry:bosh:280.1.10
-
cpe:2.3:a:cloud_foundry:bosh:280.1.11
-
cpe:2.3:a:cloud_foundry:bosh:280.1.12
-
cpe:2.3:a:cloud_foundry:bosh:280.1.13
-
cpe:2.3:a:cloud_foundry:bosh:280.1.14
-
cpe:2.3:a:cloud_foundry:bosh:280.1.15
-
cpe:2.3:a:cloud_foundry:bosh:280.1.16
-
cpe:2.3:a:cloud_foundry:bosh:280.1.17
-
cpe:2.3:a:cloud_foundry:bosh:280.1.18
-
cpe:2.3:a:cloud_foundry:bosh:280.1.19
-
cpe:2.3:a:cloud_foundry:bosh:280.1.2
-
cpe:2.3:a:cloud_foundry:bosh:280.1.20
-
cpe:2.3:a:cloud_foundry:bosh:280.1.21
-
cpe:2.3:a:cloud_foundry:bosh:280.1.22
-
cpe:2.3:a:cloud_foundry:bosh:280.1.3
-
cpe:2.3:a:cloud_foundry:bosh:280.1.4
-
cpe:2.3:a:cloud_foundry:bosh:280.1.5
-
cpe:2.3:a:cloud_foundry:bosh:280.1.6
-
cpe:2.3:a:cloud_foundry:bosh:280.1.7
-
cpe:2.3:a:cloud_foundry:bosh:280.1.8
-
cpe:2.3:a:cloud_foundry:bosh:280.1.9
-
cpe:2.3:a:cloud_foundry:bosh:281.0.0
-
cpe:2.3:a:cloud_foundry:bosh:281.0.1
-
cpe:2.3:a:cloud_foundry:bosh:282.0.0
-
cpe:2.3:a:cloud_foundry:bosh:282.0.1
-
cpe:2.3:a:cloud_foundry:bosh:282.0.10
-
cpe:2.3:a:cloud_foundry:bosh:282.0.2
-
cpe:2.3:a:cloud_foundry:bosh:282.0.3
-
cpe:2.3:a:cloud_foundry:bosh:282.0.4
-
cpe:2.3:a:cloud_foundry:bosh:282.0.5
-
cpe:2.3:a:cloud_foundry:bosh:282.0.6
-
cpe:2.3:a:cloud_foundry:bosh:282.0.7
-
cpe:2.3:a:cloud_foundry:bosh:282.0.8
-
cpe:2.3:a:cloud_foundry:bosh:282.0.9
-
cpe:2.3:a:cloud_foundry:bosh:282.1.0
-
cpe:2.3:a:cloud_foundry:bosh:282.1.1
-
cpe:2.3:a:cloud_foundry:bosh:282.1.10
-
cpe:2.3:a:cloud_foundry:bosh:282.1.11
-
cpe:2.3:a:cloud_foundry:bosh:282.1.2
-
cpe:2.3:a:cloud_foundry:bosh:282.1.3
-
cpe:2.3:a:cloud_foundry:bosh:282.1.4
-
cpe:2.3:a:cloud_foundry:bosh:282.1.5
-
cpe:2.3:a:cloud_foundry:bosh:282.1.6
-
cpe:2.3:a:cloud_foundry:bosh:282.1.7
-
cpe:2.3:a:cloud_foundry:bosh:282.1.8
-
cpe:2.3:a:cloud_foundry:bosh:282.1.9