The vulnerability identified as CVE-2026-41861 involves improper limitation of a pathname to a restricted directory (CWE-22) in the BOSH agent component of CloudFoundry Foundation's BOSH. An attacker with access to IaaS metadata can exploit this flaw to write a root-owned file with partially attacker-controlled content to any file path ending with .network. Additionally, the attacker can create any missing parent directories with permissions set to 0777 via a network alias on Ubuntu systems. The affected versions include all BOSH agent versions prior to v2.847.0, specifically jammy versions up to v1.1202 and noble versions up to v1.364. The vulnerability has a CVSS v3.1 base score of 4.2, indicating medium severity. No official patch or remediation guidance has been published yet, and no known exploits in the wild have been reported.

The vulnerability allows an attacker with access to IaaS metadata to write files as root to arbitrary paths ending in .network and create directories with wide-open permissions (0777). This could lead to limited integrity impact by modifying files and limited availability impact by potentially disrupting system components. Confidentiality is not affected. The medium CVSS score reflects the complexity and required privileges for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Users should monitor vendor communications for updates and consider restricting access to IaaS metadata services to trusted entities only as a precaution.