Blob access by clients is now protected against URL guessing. If you want to use components from earlier CMCC releases with new Content Servers, you must set the application property cap.server.blob-md5-permission-check to "false" for the new Content Servers.