CVE-2026-41011 Command injection in BOSH
Attackers can execute arbitrary commands on BOSH servers by uploading a malicious tarball with a crafted package name before validation occurs.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41011?
CVE-2026-41011 is a high-severity command injection vulnerability in Cloud Foundry Foundation BOSH, published on 4 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z_+.]+$/i) would reject the name, but in create_package (lines 74–79) the shell-out in save_package_source_blob runs before package.save, so validation fires too late.
Affected versions: - BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later
Weakness: CWE-78
Which versions are affected by CVE-2026-41011?
How do I fix CVE-2026-41011?
No fix has been published for CVE-2026-41011 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-41011 being exploited?
There is no known exploitation of CVE-2026-41011 in the wild and no public exploit code.
Sources
Also known as GHSA-96vc-39m3-22w5.