Skip to main content

Velero CVE-2026-32637

MEDIUM
Path Traversal (CWE-22)
2026-08-20 https://github.com/velero-io/velero GHSA-j2g6-362q-6qc6
Path Traversal Suse
5.9
CVSS 4.0 · Vendor: https://github.com/velero-io/velero
Share

Severity by source

Vendor (https://github.com/velero-io/velero) PRIMARY
5.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.7 HIGH

Network vector because tarball is fetched from remote storage; AC:H for required storage backend compromise; S:C because kubeconfig write enables cluster-wide impact beyond the pod.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (https://github.com/velero-io/velero).

CVSS VectorVendor: https://github.com/velero-io/velero

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
CVSS changed
Aug 25, 2026 - 22:22 NVD
5.9 (MEDIUM)
Source Code Evidence Fetched
Aug 20, 2026 - 17:56 vuln.today
Analysis Generated
Aug 20, 2026 - 17:56 vuln.today

DescriptionCVE.org

Impact

_What kind of vulnerability is it? Who is impacted?_ If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following:

  • ../../../tmp/escape_1 -> file created at /tmp/escape_1
  • ../../../../../../../../tmp/escape_2 -> file created at /tmp/escape_2
  • ../../../tmp/cron_poc -> would be /etc/cron.d/backdoor in real attack
  • ../../../tmp/ssh_poc -> would be ~/.ssh/authorized_keys
  • ../../../tmp/kubeconfig_poc -> would be ~/.kube/config

It's possible that extracting files from the tarball during restore can overwrite sensitive files in the Velero pod filesystem.

Patches

_Has the problem been patched? What versions should users upgrade to?_

By far, there is no patch yet. We are working on the main branch, then cherry-pick to the release-1.18 for v1.18.1 patch.

Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

There is no workaround, but the good news is that keeping your OSS safe will prevent the vulnerability.

AnalysisAI

Path traversal during backup restore in Velero (vmware-tanzu/velero) allows an attacker who has compromised the object storage backend to overwrite arbitrary files on the Velero pod filesystem by uploading a malicious tarball containing filenames with directory traversal sequences. Targeted files include /etc/cron.d/ entries (enabling code execution within the pod), ~/.ssh/authorized_keys (enabling persistent SSH access), and ~/.kube/config (enabling full Kubernetes cluster credential theft). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two concrete conditions: (1) the attacker must have write access to the object storage backend configured as Velero's backup storage location - this means compromising cloud storage credentials, bucket ACLs, or a service account with storage write permissions, which is a non-trivial prerequisite; and (2) a Velero restore operation must be executed against the tampered backup, which can occur through normal operator activity, automated restore testing, or disaster recovery procedures. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk is meaningful but gated behind a significant prerequisite: the attacker must first compromise the object storage backend (e.g., obtain write access to the S3 bucket or equivalent). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Velero to version 1.18.1 or later, which is the confirmed fixed version per package metadata (the advisory was written before the patch was released; the fix has since been committed to the release-1.18 branch). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Share

CVE-2026-32637 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy