CVE-2026-66797

A flaw was found in the cluster-backup-operator. An attacker with write access to the backup storage location or the ability to create a Velero Backup object can inject malicious Role-Based Access Control RBAC resources into a backup. When this tampered backup is restored, the operator processes...