{"id":"CVE-2026-32637","title":"Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes","summary":"Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarb…","severity":"medium","cwe":["CWE-22"],"vendor":"vmware-tanzu","product":"github.com/vmware-tanzu/velero","affected":["github.com/vmware-tanzu/velero < 1.18.1"],"patched":["github.com/vmware-tanzu/velero 1.18.1"],"published":"2026-08-25","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32637","references":[{"url":"https://github.com/securego/gosec/issues/324","label":"security-advisories@github.com"},{"url":"https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0","label":"security-advisories@github.com"},{"url":"https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c","label":"security-advisories@github.com"},{"url":"https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-j2g6-362q-6qc6"}],"tags":["nvd","ghsa","go"],"epss":0.00514,"epssPercentile":0.42806,"aliases":["GHSA-j2g6-362q-6qc6"],"ecosystem":"go","ingestedAt":"2026-08-20T17:59:06.023Z","slug":"CVE-2026-32637","body":"## Overview\n\nVelero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-32637)\n\nAffected packages:\n\n- `github.com/vmware-tanzu/velero < 1.18.1`\n\nPatched in:\n\n- `github.com/vmware-tanzu/velero 1.18.1`\n\nSource: https://github.com/advisories/GHSA-j2g6-362q-6qc6","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}