EUVD-2026-54219
GHSA-hr6c-84vf-jf53
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Adjacent vector reflects IaaS-metadata-only exposure; AC:H for the specific tenant-level metadata access required; I:L and A:L because write is path-suffix-constrained with partial body control.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
2DescriptionCVE.org
Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu.
Affected versions: BOSH agent < v2.847.0 (jammy <= v1.1202, or noble <= v1.364). Lower bound unspecified in advisory ("All bosh agent versions").
AnalysisAI
Path traversal in the BOSH agent on Ubuntu allows an attacker positioned to manipulate IaaS metadata to cause the agent to write a root-owned file with partially attacker-controlled content to any filesystem path ending in '.network', while also creating missing parent directories with insecure 0777 permissions. All BOSH agent versions prior to v2.847.0 on Ubuntu jammy (<=v1.1202) and noble (<=v1.364) are affected. No public exploit has been identified and this is not listed in CISA KEV; however, the root-write primitive combined with 0777 directory creation warrants prompt patching in any Cloud Foundry or BOSH-managed deployment.
Technical ContextAI
BOSH (BOSH Outer Shell) is the Cloud Foundry foundation's release-engineering and VM lifecycle management system. The BOSH agent runs as a privileged daemon on every BOSH-managed VM, receiving instructions and configuration via the IaaS metadata channel (e.g., AWS user-data, GCP metadata server). The vulnerability arises in the agent's handling of network Alias configuration on Ubuntu, where systemd-networkd '.network' unit files govern interface configuration. CWE-22 (Path Traversal) indicates the agent fails to canonicalize or restrict the destination path when writing these configuration files, permitting directory traversal sequences in an alias value to redirect the write to an arbitrary location - provided the resolved path retains the '.network' suffix. Additionally, any missing parent directories in the traversed path are created with mode 0777, exposing those directories to world-write access. Affected CPE: BOSH agent versions <2.847.0 per EUVD-2026-54219.
RemediationAI
Upgrade the BOSH agent to v2.847.0 or later; on Ubuntu jammy, deploy a stemcell newer than v1.1202, and on Ubuntu noble, deploy a stemcell newer than v1.364. The vendor-released patch is confirmed available per the Cloud Foundry advisory at https://www.cloudfoundry.org/blog/cve-2026-41861-arbitrary-root-file-write-via-path-traversal-in-bosh-agent/. If immediate stemcell rotation is not possible, a compensating control is to restrict who can write to or inject values into the IaaS metadata channel for BOSH-managed VMs - on AWS, enforce strict IAM policies preventing unauthorized modification of user-data; on GCP, restrict access to the Compute Engine metadata server via OS-level firewall rules (iptables block of 169.254.169.254 for unprivileged processes). Be aware that blocking metadata access entirely may break BOSH agent bootstrap and other cloud-init dependent functionality, so apply at the IAM/tenant boundary rather than at the VM level.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today