EUVD-2026-89463
GHSA-hjpg-q85j-gwxx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required backup-catalog write access; AC:H for the mandatory separate-principal deployment precondition; S:C as impact hits cloud snapshots under a different authority; C:N, I/A:H for destructive deletion.
Primary rating from Vendor (EDB).
CVSS VectorVendor: EDB
Lifecycle Timeline
4DescriptionCVE.org
Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the backup.info file and passes them to the cloud provider's delete API using Barman's own credentials, without verifying that the snapshots belong to that backup. An attacker who can overwrite backup.info but lacks snapshot delete permissions can substitute the identifiers of other snapshots, causing Barman to delete any snapshot its cloud identity can reach on AWS, Microsoft Azure, or Google Cloud. Exploitation requires a deployment where the principal that writes the backup catalog is separate from the identity Barman uses to delete snapshots. Barman versions from 3.4.0 (Google Cloud), 3.6.0 (Azure), and 3.7.0 (AWS) up to and including 3.20.0 are affected. The issue is fixed in Barman 3.20.1.
AnalysisAI
Deletion of arbitrary cloud snapshots on AWS, Microsoft Azure, or Google Cloud can be triggered through Barman 3.4.0/3.6.0/3.7.0 (per provider) through 3.20.0, because the snapshot deletion path reads snapshot identifiers from the backup catalog (backup.info) and passes them to the cloud provider's delete API using Barman's own credentials without verifying that those snapshots belong to the backup being removed. An authenticated, low-privileged principal who can overwrite backup.info but does not hold snapshot-delete permissions can substitute the identifiers of unrelated snapshots, causing Barman to delete any snapshot its cloud identity can reach; deletion occurs either on explicit backup deletion or automatically when a retention policy is enforced, so no further admin action is needed once the forged catalog entry exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a deployment where the identity/principal that can write the Barman backup catalog (specifically the backup.info file) is SEPARATE from the cloud identity Barman uses to delete snapshots - this privilege separation is the mandatory precondition; single-identity deployments are not exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine integrity/availability risk but a conditional one, not a broad-exposure emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Barman 3.20.1, which is the vendor-released fix and restores ownership verification in the snapshot deletion path; see the advisory at https://www.enterprisedb.com/docs/security/advisories/cve202693853/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Barman deployments to identify versions 3.4.0, 3.6.0, 3.7.0 through 3.20.0 (per provider) and immediately restrict write access to backup.info files to only trusted backup administrators; review and remove snapshot-delete permissions from the cloud identity used by Barman unless absolutely necessary. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-283 – Unverified Ownership
View allShare
External POC / Exploit Code
Leaving vuln.today