CVE-2026-29064: Zarf Path Traversal Vulnerability

CVE-2026-29064 Overview

CVE-2026-29064 is a path traversal vulnerability in Zarf, an airgap-native package manager for Kubernetes maintained by the Linux Foundation Projects (lfprojects). The flaw affects Zarf versions 0.54.0 through versions prior to 0.73.1. A specifically crafted Zarf package can create symbolic links during archive extraction that point outside the intended destination directory. Attackers exploiting this weakness gain arbitrary file read or write access on the host processing the malicious package. The Zarf maintainers patched the issue in version 0.73.1.

Critical Impact
Processing a malicious Zarf package allows arbitrary file read and write on the host system, enabling configuration tampering, secret theft, and downstream compromise of Kubernetes deployment pipelines.

Affected Products

Zarf 0.54.0 through versions before 0.73.1
Zarf CLI used in Kubernetes airgap packaging workflows
CI/CD pipelines and operator hosts that consume untrusted Zarf packages

Discovery Timeline

2026-03-06 - CVE-2026-29064 published to NVD
2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-29064

Vulnerability Analysis

The vulnerability is classified as a path traversal weakness [CWE-22] in Zarf's archive extraction logic. Zarf packages bundle Kubernetes manifests, container images, and supporting files into a single archive distributed across airgapped environments. When Zarf extracts a package, the extraction routine fails to validate the target paths of symbolic link entries. An attacker who controls the package contents can include symlink entries whose link targets resolve outside the intended extraction directory. Subsequent file operations follow these symlinks, allowing the attacker to read sensitive files or overwrite arbitrary locations writable by the Zarf process.

Root Cause

The root cause is insufficient sanitization of symbolic link targets during archive extraction. The extraction code does not normalize link targets against the destination root or reject links that traverse parent directories using ../ sequences. Once a malicious symlink is written to disk, follow-up writes intended for files inside the extraction directory are redirected through the symlink to attacker-chosen locations on the host filesystem.

Attack Vector

Exploitation requires a victim to process an attacker-supplied Zarf package using a vulnerable Zarf version. The attack vector is local and requires user interaction, since the operator must initiate the package extraction. After extraction, the attacker can read sensitive files such as kubeconfig credentials, service account tokens, or SSH keys, and write to system locations including shell startup files, systemd unit files, or Kubernetes manifest directories. The scope changes during exploitation because file operations performed by the Zarf process can affect resources outside its trust boundary, including downstream Kubernetes clusters.

No public proof-of-concept is currently available. Refer to the GitHub Security Advisory GHSA-hcm4-6hpj-vghm for vendor technical details.

Detection Methods for CVE-2026-29064

Indicators of Compromise

Symbolic links inside extracted Zarf package directories whose targets resolve outside the extraction root or contain ../ sequences.
Unexpected modifications to sensitive files such as ~/.ssh/authorized_keys, ~/.kube/config, /etc/cron.d/, or systemd unit directories shortly after running zarf package deploy.
Zarf processes performing file reads or writes outside their working directory or package staging path.

Detection Strategies

Audit Zarf binaries deployed across build agents and operator workstations and flag any version between 0.54.0 and 0.73.0.
Inspect Zarf package archives prior to deployment using tar -tvf or equivalent tooling to enumerate symlink entries and validate their targets.
Correlate process telemetry for the zarf binary with filesystem writes to locations outside the configured package directory.

Monitoring Recommendations

Enable filesystem auditing on hosts that run Zarf, focusing on writes to credential stores, SSH directories, and Kubernetes configuration paths.
Log and review the provenance of every Zarf package processed in CI/CD pipelines, retaining package hashes for forensic analysis.
Alert on Zarf invocations that originate from untrusted sources or are executed outside approved deployment workflows.

How to Mitigate CVE-2026-29064

Immediate Actions Required

Upgrade Zarf to version 0.73.1 or later on all systems that build, sign, or deploy Zarf packages.
Treat any Zarf package received from an untrusted origin as suspect until inspected with a patched version.
Rotate credentials accessible to hosts that may have processed untrusted packages with a vulnerable Zarf version.

Patch Information

The issue is fixed in Zarf 0.73.1. Download details are available in the Zarf Release v0.73.1 notes. The patch enforces validation of symlink targets so they cannot resolve outside the destination directory during archive extraction.

Workarounds

Restrict Zarf execution to dedicated, low-privilege service accounts that lack access to host secrets or cluster credentials.
Process Zarf packages inside ephemeral containers or sandboxed virtual machines where filesystem writes cannot affect production hosts.
Verify package signatures and provenance before deployment, and reject packages from sources outside the established supply chain.

bash

# Verify installed Zarf version and upgrade to the patched release
zarf version

# Replace the binary with the patched release (Linux x86_64 example)
curl -sSfL -o zarf https://github.com/zarf-dev/zarf/releases/download/v0.73.1/zarf_v0.73.1_Linux_amd64
chmod +x zarf
sudo mv zarf /usr/local/bin/zarf

# Confirm the upgrade
zarf version