Which versions of Barman are affected by EUVD-2026-89463?

Barman backup management software versions 3.4.0 through 3.20.0 contain a high-severity vulnerability that could allow an attacker to delete arbitrary cloud snapshots on AWS, Azure, or Google Cloud.. A patch is available.

How to fix or mitigate EUVD-2026-89463?

Within 24 hours, inventory all Barman deployments to identify versions 3.4.0, 3.6.0, 3.7.0 through 3.20.0 (per provider) and immediately restrict write access to backup.info files to only trusted backup administrators; review and remove snapshot-delete permissions from the cloud identity used by Barman unless absolutely necessary. Within 7 days, enable cloud provider audit logging for snapshot deletion events and set alerts, implement file integrity monitoring on backup catalogs, and enforce separation of duties so that the principal writing the catalog cannot also delete snapshots. Within 30 days, apply the vendor patch as soon as it is released (no vendor-released patch identified at time of analysis), and if not available, continue least-privilege enforcement while evaluating alternative backup solutions or temporarily disabling automated retention policies.

Barman EUVD-2026-89463

Q: What is the CVSS score of EUVD-2026-89463?

EUVD-2026-89463 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-93853 HIGH

Unverified Ownership (CWE-283)

2026-09-29 EDB

GHSA-hjpg-q85j-gwxx

Google Microsoft Barman Enterprisedb

7.2

CVSS 4.0 · Vendor: EDB

Severity by source

Vendor (EDB) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

PR:L for required backup-catalog write access; AC:H for the mandatory separate-principal deployment precondition; S:C as impact hits cloud snapshots under a different authority; C:N, I/A:H for destructive deletion.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Primary rating from Vendor (EDB).

CVSS VectorVendor: EDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 29, 2026 - 22:19 EUVD

Metadata Corrected

Sep 29, 2026 - 21:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 29, 2026 - 21:36 vuln.today

CVE Published

Sep 29, 2026 - 20:55 cve.org

HIGH 7.2

DescriptionCVE.org

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the backup.info file and passes them to the cloud provider's delete API using Barman's own credentials, without verifying that the snapshots belong to that backup. An attacker who can overwrite backup.info but lacks snapshot delete permissions can substitute the identifiers of other snapshots, causing Barman to delete any snapshot its cloud identity can reach on AWS, Microsoft Azure, or Google Cloud. Exploitation requires a deployment where the principal that writes the backup catalog is separate from the identity Barman uses to delete snapshots. Barman versions from 3.4.0 (Google Cloud), 3.6.0 (Azure), and 3.7.0 (AWS) up to and including 3.20.0 are affected. The issue is fixed in Barman 3.20.1.

AnalysisAI

Deletion of arbitrary cloud snapshots on AWS, Microsoft Azure, or Google Cloud can be triggered through Barman 3.4.0/3.6.0/3.7.0 (per provider) through 3.20.0, because the snapshot deletion path reads snapshot identifiers from the backup catalog (backup.info) and passes them to the cloud provider's delete API using Barman's own credentials without verifying that those snapshots belong to the backup being removed. An authenticated, low-privileged principal who can overwrite backup.info but does not hold snapshot-delete permissions can substitute the identifiers of unrelated snapshots, causing Barman to delete any snapshot its cloud identity can reach; deletion occurs either on explicit backup deletion or automatically when a retention policy is enforced, so no further admin action is needed once the forged catalog entry exists. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a deployment where the identity/principal that can write the Barman backup catalog (specifically the backup.info file) is SEPARATE from the cloud identity Barman uses to delete snapshots - this privilege separation is the mandatory precondition; single-identity deployments are not exploitable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine integrity/availability risk but a conditional one, not a broad-exposure emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Barman 3.20.1, which is the vendor-released fix and restores ownership verification in the snapshot deletion path; see the advisory at https://www.enterprisedb.com/docs/security/advisories/cve202693853/. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Barman deployments to identify versions 3.4.0, 3.6.0, 3.7.0 through 3.20.0 (per provider) and immediately restrict write access to backup.info files to only trusted backup administrators; review and remove snapshot-delete permissions from the cloud identity used by Barman unless absolutely necessary. …

Threat intelligence, references, and detailed analysis are available after sign-in.