{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": "cpe:2.3:a:cloud_foundry:bosh:*:*:*:*:*:*:*:*",
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "282.1.12"
              }
            ],
            "source": "CPE_RANGE"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "86ee55839a6ee2ffa73e20dfe1e7622f6f91e3f6"
            }
          ],
          "repo": "https://github.com/cloudfoundry/bosh",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "vmware",
    "cwe_ids": [
      "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41704.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "fixed": "282.1.12"
          }
        ],
        "source": "AFFECTED_FIELD"
      }
    ]
  },
  "details": "AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any response containing 'exception' goes through format_exception (lines 308-325), which reads exception['blobstore_id'] and also calls download_and_delete_blob. That helper (lines 344-349) calls ResourceManager#get_resource(blob_id) and, in an ensure block, ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix.\n\nAffected versions:\nBOSH Director: All versions prior to v282.1.12",
  "id": "CVE-2026-41704",
  "modified": "2026-08-12T03:51:46.451278004Z",
  "published": "2026-05-27T07:13:15.525Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41704.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41704"
    },
    {
      "type": "ARTICLE",
      "url": "https://www.cloudfoundry.org/blog/cve-2026-41704-compromised-vm-can-make-arbitrary-blobstore-deletes/"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Compromised VM can make arbitrary blobstore deletes"
}