CVE-2026-29190: Aiven Karapace Path Traversal Vulnerability

CVE-2026-29190 Overview

CVE-2026-29190 is a Path Traversal vulnerability in Aiven Karapace, an open-source implementation of Kafka REST and Schema Registry. The vulnerability exists in the backup reader component (backup/backends/v3/backend.py) and allows attackers to perform arbitrary file reads on systems running Karapace when processing malicious backup files.

Critical Impact

Attackers can exploit insufficient path validation to read arbitrary files on the system, potentially exposing sensitive configuration data, credentials, and other confidential information depending on the Karapace process's file system permissions.

Affected Products

• Aiven Karapace versions prior to 6.0.0
• Deployments utilizing the backup/restore functionality
• Systems processing backups from untrusted sources

Discovery Timeline

• 2026-03-07 - CVE-2026-29190 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-29190

Vulnerability Analysis

This Path Traversal vulnerability (CWE-22) affects the backup reader functionality in Karapace's backup/backends/v3/backend.py module. The vulnerability stems from insufficient validation of file paths when processing backup files. When a malicious backup file is provided to Karapace, an attacker can manipulate path components to escape the intended directory structure and access files outside the designated backup location.

The vulnerability is exploitable over the network without requiring authentication or user interaction. However, the impact is limited to confidentiality—attackers can read files but cannot modify data or cause denial of service through this specific vulnerability. The actual data exposure depends on what files are accessible to the Karapace process based on its runtime permissions and the underlying file system configuration.

Root Cause

The root cause of CVE-2026-29190 is insufficient path validation in the backup reader component. The backup/backends/v3/backend.py module does not properly sanitize or validate file paths extracted from backup files before using them in file system operations. This allows specially crafted backup files containing path traversal sequences (such as ../) to reference files outside the intended backup directory.

Attack Vector

The attack vector requires an attacker to provide a malicious backup file to a Karapace instance that uses the backup/restore functionality. The attacker crafts a backup file containing path traversal sequences that, when processed by the backup reader, cause Karapace to read arbitrary files from the file system. This is particularly dangerous in environments where backup files may be sourced from untrusted origins or shared storage locations.

The attack does not require authentication and can be executed remotely over the network. The attacker would typically target sensitive files such as configuration files, credentials, or other data accessible to the Karapace process.

Detection Methods for CVE-2026-29190

Indicators of Compromise

• Unusual file access patterns from the Karapace process, particularly reads outside the backup directory structure
• Backup files containing suspicious path sequences such as ../ or absolute paths
• Log entries showing file access errors for paths outside normal backup locations
• Evidence of sensitive file access (e.g., /etc/passwd, configuration files) correlated with backup operations

Detection Strategies

• Monitor file system access by the Karapace process for reads outside expected directories
• Implement file integrity monitoring on sensitive system files and configuration directories
• Analyze backup files for path traversal sequences before processing
• Review Karapace application logs for anomalous backup processing activities

Monitoring Recommendations

• Enable detailed logging for Karapace backup and restore operations
• Configure alerts for file access attempts outside normal backup paths
• Implement network monitoring for unusual data exfiltration patterns following backup operations
• Deploy endpoint detection and response (EDR) solutions to monitor process behavior and file access patterns

How to Mitigate CVE-2026-29190

Immediate Actions Required

• Upgrade Aiven Karapace to version 6.0.0 or later immediately
• Audit backup sources and restrict backup file acceptance to trusted origins only
• Review file system permissions for the Karapace process and apply least-privilege principles
• Scan existing backup files for potential path traversal sequences before processing

Patch Information

Aiven has released version 6.0.0 of Karapace which addresses this vulnerability. The patch implements proper path validation in the backup reader component to prevent path traversal attacks. Organizations should upgrade to this version as soon as possible.

For detailed patch information, see the GitHub Release 6.0.0 and the GitHub Security Advisory GHSA-rw4j-p3jg-4fxq.

Workarounds

• Restrict backup file sources to trusted and verified origins only until patching is complete
• Run the Karapace process with minimal file system permissions using principle of least privilege
• Implement network segmentation to limit the impact of potential data exfiltration
• Disable or restrict access to the backup/restore functionality if not actively required

# Configuration example - Run Karapace with restricted permissions
# Create a dedicated user with minimal privileges
useradd -r -s /bin/false karapace-service

# Restrict file system access
chown -R karapace-service:karapace-service /opt/karapace/data
chmod 700 /opt/karapace/data

# Run Karapace as restricted user
su -s /bin/bash -c '/opt/karapace/bin/karapace' karapace-service