PT-2026-105640

These are all security issues fixed in the velero-1.18.4-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11931-1 velero-1.18.4-1.1 on GA media

These are all security issues fixed in the velero-1.18.4-1.1 package on the GA media of openSUSE Tumbleweed...

CLEANSTART-2026-DK18368 Security fix for ghsa-m6hq-p25p-ffr2 applied in: argo-cd-fips 2.13.9-r4, cert-manager-cmctl 2.3.0-r0, helm-fips 3.17-4-r1, helm-fips 3.19.0-r1, helm-fips 3.19.0-r2, k8sgpt 0.4.26-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, kaniko 1.24.0-r0, kaniko-fips 1.24.0-r0, kubevela 1.10.4-r0, kubevela 1.10.5-r0, skaffold 2.16.1-r1, trivy-fips 0.67.2-r0, velero 1.17.0-r0

ghsa-m6hq-p25p-ffr2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OT80419 Security fix for CVE-2025-46394 applied in: velero 1.17.0-r0

Security vulnerability affects the velero package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-SG37837 Security fix for CVE-2025-58251 applied in: velero 1.17.0-r0

Security vulnerability affects the velero package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-BL39190 Security fix for ghsa-w67g-5rqw-f597 applied in: vault 1.19.5-r3, vault 1.20.4-r9, velero 1.15.2-r8

ghsa-w67g-5rqw-f597 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZM91804 Security fix for CVE-2026-32637 applied in: velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.13.2-r6, velero-plugin-for-aws 1.14.2-r1

CVE-2026-32637 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-101316

Security vulnerability affects the velero package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101652

Security vulnerability affects the velero package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UX51431 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the velero-fips package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-GW77529 Previously, resolving relative paths containing parent directory ('

Multiple security vulnerabilities affect the velero-plugin-for-csi package. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-WA59044 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the velero-plugin-for-csi package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CVE-2026-32637

A flaw was found in Velero, an open-source tool for managing Kubernetes backups. An attacker who compromises the backup object-storage backend can upload a specially crafted malicious backup file. During the restore process, this malicious file can exploit a path traversal vulnerability to...

SUSE CVE-2026-32637

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

GO-2026-6259 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-gcp-fips, velero-plugin-for-gcp, velero-plugin-for-aws-fips, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-aws, velero-plugin-for-microsoft-azure...

GO-2026-6259 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-microsoft-azure, velero-plugin-for-aws...

CVE-2026-32637

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

EUVD-2026-66117

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

CVE-2026-32637 Velero vulnerable to file path traversal when extracting from backup's tarball

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

CVE-2026-32637 Velero vulnerable to file path traversal when extracting from backup's tarball

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...