BOSH Director EUVD-2026-32098

The local blobstore provider must be explicitly configured on the BOSH Director - deployments using S3, Azure Blob, GCS, or other non-filesystem blobstore backends are not affected. The attacker must have already achieved high-privilege control of a BOSH agent VM (PR:H), which is a substantial prerequisite representing a prior compromise or insider threat scenario. A long-running Director task such as compile_package must be actively in progress at the time of exploitation (AT:P precondition; UI:P). The attack vector is local (AV:L) and attack complexity is high (AC:H), meaning opportunistic or automated exploitation is not feasible. Exploitation is limited to: (1) attackers who have already compromised a managed agent VM, (2) environments using the local blobstore provider, and (3) windows when compile or similarly long-running tasks are executing. These combined barriers mean the realistic exposed population is narrow, primarily internal threat actors or post-compromise lateral movement scenarios within BOSH-managed infrastructure.

Real-world risk is substantially lower than the integrity-focused CVSS vector might suggest in isolation. The CVSS 4.0 score of 4.3 (Medium) encodes multiple high-friction prerequisites: AV:L (local attack vector - attacker must have presence on the Director's network or host), AC:H (high complexity), AT:P (specific precondition - local blobstore must be configured), PR:H (high privileges - a BOSH agent VM must already be compromised or controlled), and UI:P (user interaction - a long-running task must be in flight). EPSS sits at 0.01% (1st percentile), confirming extremely low exploitation probability across the broader threat landscape. SSVC signals corroborate this: exploitation status 'none,' automatable 'no,' and technical impact 'partial.' This vulnerability is not in CISA KEV. One notable discrepancy exists: the CVSS vector records VC:N (no confidentiality impact to the vulnerable system), yet both the blog title ('arbitrary reads') and the code path description confirm that blobstore.get(id) executes and returns file contents before blobstore.delete(id) runs. This suggests the CVSS may understate the confidentiality dimension; defenders should verify with the Cloud Foundry advisory whether file contents are exposed to the attacker-controlled agent or only consumed internally by the Director process.

An attacker who has already compromised a BOSH agent VM - or who controls an agent through a prior deployment-level breach - waits for the Director to issue a compile_package long-running request. The attacker forges or intercepts the agent's JSON reply, replacing the legitimate compile_log_id value with a path traversal string such as '../../jobs/director/config/director.yml'. The Director's AgentClient passes this string unmodified to download_and_delete_blob, causing the Director to read and then permanently delete the Director's own configuration file from disk. No public exploit code has been identified at time of analysis.