CVE-2026-41704 allows an attacker who has compromised a VM in a Cloud Foundry environment to trigger arbitrary deletions of blobstore objects within the BOSH Director's shared blobstore. The vulnerability arises from the AgentClient's handling of every NATS reply; it invokes a helper that unconditionally calls delete_resource on the blobstore without performing any ownership or format validation. As a result, any attacker capable of generating a crafted NATS message can cause the Director to delete any blob, leading to data loss and service disruption. The flaw is an instance of improper access control (CWE‑284).

Cloud Foundry Foundation BOSH Director installations with versions earlier than 282.1.12 are affected. The vulnerability is present in all prior releases of the Director produced by the Cloud Foundry Foundation. No other vendors or products are mentioned.

The CVSS score of 6.8 indicates medium severity. EPSS is not available, so the likelihood estimate is unknown from the data. KEV does not list this vulnerability, so it is not confirmed as currently exploited in the wild. The attack requires that an actor has control over a VM that can send NATS replies; thus the vector is likely internal network compromise. If an attacker can reach the BOSH Director, they can trigger the deletion path and remove arbitrary resources. Given the lack of access control checks, the exploitability is high once the victim VM is compromised, but does not allow remote code execution or privilege escalation outside of blob deletion.