CVE-2026-41010: BOSH Director Shell Injection via Release Job Names

Technical summary

CVE-2026-41010 is a shell injection vulnerability in BOSH Director's ReleaseJob#unpack method. The flaw occurs because job names from the attacker-supplied release.MF manifest file are interpolated directly into a tar extraction command executed via /bin/sh. While FileUtils.mkdir_p creates directories safely (interpreting the path literally), the subsequent Bosh::Common::Exec.sh call processes the same unsanitized name through shell execution via %x{} interpolation. An attacker can inject shell metacharacters (such as $(), backticks, semicolons, or pipes) in the job name field to break out of the intended tar command and execute arbitrary shell code. This affects all BOSH Director versions prior to v282.1.12.

Business impact

Successful exploitation allows an authenticated attacker with high privileges to gain code execution on BOSH Director systems, potentially compromising the entire deployment infrastructure. BOSH Director manages infrastructure automation and orchestration across cloud deployments; compromise enables lateral movement, data theft, manipulation of deployments, and persistence mechanisms. Organizations relying on BOSH for infrastructure as code face significant operational and security risk if their Directors are unpatched.

Affected systems

BOSH Director versions prior to v282.1.12 are vulnerable. The attack requires an attacker to upload a malicious release tarball, which presupposes authenticated access with release upload privileges—typically a high-privilege user role. No unauthenticated remote exploitation is possible; however, insider threats or compromised administrative accounts pose substantial risk.

Exploitability

Exploitation requires high-privilege authentication (release management/administrator role) and the ability to upload a crafted tarball. Once those conditions are met, the attack is straightforward: inject shell metacharacters into the job name field of the release manifest. The shell interprets these characters reliably, and no additional user interaction or race conditions are needed. While not remotely unauthenticated, the attack is technically simple and reliable against vulnerable versions.

Remediation

Upgrade BOSH Director to v282.1.12 or later. The patched version sanitizes job names before shell interpolation, preventing metacharacter injection. Organizations should prioritize patching given the high severity and the role BOSH plays in infrastructure automation. Before patching, implement access controls to restrict who can upload releases to BOSH Director.

Patch guidance

Update BOSH Director to v282.1.12 or a later release. Verify the upgrade in a test environment first to ensure compatibility with your deployment configuration. After upgrade, restart the BOSH Director service and validate that existing releases and deployments continue to function. Check the official BOSH release notes for any breaking changes or additional migration steps.

Detection guidance

Monitor BOSH Director logs for failed or suspicious tar extraction operations, especially those with unusual job names containing shell metacharacters ($, backticks, semicolons, pipes, etc.). Watch for unexpected child processes spawned by the BOSH Director process during release uploads. Implement file integrity monitoring on the release directory to detect unauthorized file creation. In high-security environments, enable shell command auditing (auditd on Linux) to capture injected commands.

Why prioritize this

This vulnerability scores 8.2 (HIGH) due to high impact (confidentiality, integrity, and availability all compromised), but requires high privilege to exploit. Organizations should prioritize patching based on their access control posture: if release upload privileges are tightly restricted to trusted administrators, risk is lower; if access is broader or if insider threats are a concern, treat as urgent. The ease of exploitation once authenticated argues for expedited patching across all environments.

Risk score, explained

CVSS 3.1 score of 8.2 reflects the combination of local attack vector (releases are uploaded to Director), high privilege requirement (PR:H), absence of user interaction (UI:N), and complete impact across confidentiality, integrity, and availability (C:H, I:H, A:H). The score appropriately captures that while authentication is required, the consequences of compromise are severe. The scope change (S:C) indicates that compromising the Director affects other systems it orchestrates.

Frequently asked questions