Barman
Monthly
Deletion of arbitrary cloud snapshots on AWS, Microsoft Azure, or Google Cloud can be triggered through Barman 3.4.0/3.6.0/3.7.0 (per provider) through 3.20.0, because the snapshot deletion path reads snapshot identifiers from the backup catalog (backup.info) and passes them to the cloud provider's delete API using Barman's own credentials without verifying that those snapshots belong to the backup being removed. An authenticated, low-privileged principal who can overwrite backup.info but does not hold snapshot-delete permissions can substitute the identifiers of unrelated snapshots, causing Barman to delete any snapshot its cloud identity can reach; deletion occurs either on explicit backup deletion or automatically when a retention policy is enforced, so no further admin action is needed once the forged catalog entry exists. Exploitation is conditional, not universal: it requires a deployment in which the principal that writes the backup catalog is separate from the cloud identity Barman uses to delete snapshots, and single-identity deployments are not exploitable (CVSS 4.0 base 7.2). No public exploit code has been identified at time of analysis, and the vendor-released fix is Barman 3.20.1.
Deletion of arbitrary cloud snapshots on AWS, Microsoft Azure, or Google Cloud can be triggered through Barman 3.4.0/3.6.0/3.7.0 (per provider) through 3.20.0, because the snapshot deletion path reads snapshot identifiers from the backup catalog (backup.info) and passes them to the cloud provider's delete API using Barman's own credentials without verifying that those snapshots belong to the backup being removed. An authenticated, low-privileged principal who can overwrite backup.info but does not hold snapshot-delete permissions can substitute the identifiers of unrelated snapshots, causing Barman to delete any snapshot its cloud identity can reach; deletion occurs either on explicit backup deletion or automatically when a retention policy is enforced, so no further admin action is needed once the forged catalog entry exists. Exploitation is conditional, not universal: it requires a deployment in which the principal that writes the backup catalog is separate from the cloud identity Barman uses to delete snapshots, and single-identity deployments are not exploitable (CVSS 4.0 base 7.2). No public exploit code has been identified at time of analysis, and the vendor-released fix is Barman 3.20.1.