GO-2026-6259 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws-fips, velero-plugin-for-aws, velero-plugin-for-microsoft-azure, velero-plugin-for-gcp, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-gcp-fips...

GO-2026-6259 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-microsoft-azure, velero-plugin-for-aws...

CVE-2026-32637

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

CVE-2026-32637 Velero vulnerable to file path traversal when extracting from backup's tarball

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

CVE-2026-32637

Velero is an open-source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1 , a file path traversal vulnerability exists during restore: an attacker who compromises the backup object-storage backend can upload a malicious tarball con...

CVE-2026-32637 Velero vulnerable to file path traversal when extracting from backup's tarball

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

GO-2026-6259 Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero

Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero...

GHSA-J2G6-362Q-6QC6 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws-fips, velero-plugin-for-aws, velero-plugin-for-microsoft-azure, velero-plugin-for-gcp, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-gcp-fips...

CVE-2026-32637 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws-fips, velero-plugin-for-aws, velero-plugin-for-microsoft-azure, velero-plugin-for-gcp, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-gcp-fips...

CVE-2026-32637 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-microsoft-azure, velero-plugin-for-aws...

GHSA-J2G6-362Q-6QC6 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-microsoft-azure, velero-plugin-for-aws...

Velero vulnerable to file path traversal when extracting from backup's tarball

Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 - file created at /tmp/escape1 ../../../../../../../../tmp/escape2 - file...

GHSA-J2G6-362Q-6QC6 Velero vulnerable to file path traversal when extracting from backup's tarball

Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 - file created at /tmp/escape1 ../../../../../../../../tmp/escape2 - file...

PT-2026-80731

Name of the Vulnerable Software and Affected Versions Velero versions prior to 1.18.1 Description An attacker who gains control of the backup object-storage backend can upload a malicious backup tarball. This tarball can contain parent-directory paths that allow files to escape the intended...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, prometheus-adapter-fips, amazon-ssm-agent, cluster-api-helm-controller-fips, syncthing, terraform-provider-azuread, terraform-ls, sealed-secrets, chart-testing, newrelic-nri-statsd, age-fips, fscrypt, promxy, spqr, falcoctl-fips,...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, kubernetes-csi-external-provisioner, tflint, newrelic-infra-operator, falcoctl-fips, kyverno-policy-reporter, prometheus-pushgateway, gomplate, grpcurl, nats, php-fpmexporter, cosign-fips, pulumi-kubernetes-operator, request-1279,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, falcoctl, chezmoi, thanos, harbor-registry, velero, terragrunt, rclone, up, zot, hugo, trino, zarf, airflow, prometheus-operator, grafana-agent-operator, sigstore-scaffolding, argo-workflows, grafana-mimir, wal-g, cosign, boring-registry,...

CLEANSTART-2026-EL49045 Security fixes in velero-plugin-for-gcp-fips 1.14.2-r1

Package velero-plugin-for-gcp-fips version 1.14.2-r1 fixes 2 vulnerabilities: CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-JT66111 Security fixes in velero-plugin-for-aws-fips 1.13.2-r1

Package velero-plugin-for-aws-fips version 1.13.2-r1 fixes 13 vulnerabilities: CVE-2026-39822, CVE-2026-42505, CVE-2026-33186, CVE-2026-25681, CVE-2026-27136...

CLEANSTART-2026-IK78865 Security fixes in velero-plugin-for-aws-fips 1.14.2-r1

Package velero-plugin-for-aws-fips version 1.14.2-r1 fixes 11 vulnerabilities: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39822...