CVE-2026-32637: Velero Path Traversal Vulnerability

CVE-2026-32637 Overview

CVE-2026-32637 is a path traversal vulnerability [CWE-22] in Velero, an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Versions prior to 1.18.1 fail to validate archive entry paths during backup restoration. An attacker who compromises the backup object-storage backend can upload a malicious tarball containing parent-directory (../) sequences. During restore, the extractor writes files outside the intended directory and overwrites sensitive files in the Velero pod filesystem. The issue is patched in Velero 1.18.1.

Critical Impact
An attacker with control over the backup storage backend can overwrite arbitrary files inside the Velero pod, leading to integrity and availability compromise of the backup and restore infrastructure.

Affected Products

Velero versions prior to 1.18.1
Kubernetes clusters using Velero for backup and restore
Velero-managed object-storage backends (S3, Azure Blob, GCS)

Discovery Timeline

2026-08-25 - CVE CVE-2026-32637 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-32637

Vulnerability Analysis

The vulnerability resides in Velero's archive extraction routine at pkg/archive/extractor.go. Velero restores Kubernetes state from tarballs stored in an object-storage backend. When iterating entries in a tar.gz archive, the extractor concatenates the entry's declared path with the extraction target directory without validating the resulting path. This is a classic Zip Slip pattern in the Go tar/gzip pipeline.

An attacker with write access to the storage bucket crafts a malicious backup tarball containing entries with names such as ../../etc/passwd or paths pointing into the Velero pod's writable directories. When an operator triggers a restore, Velero extracts these entries and writes attacker-controlled content outside the intended extraction root. Overwriting binaries, configuration, or credentials inside the Velero pod filesystem enables tampering with subsequent backup and restore operations.

Root Cause

The extractor did not enforce that resolved output paths remain within the target directory. The Go static analyzer gosec flags this pattern as G305 (see GitHub Gosec Issue #324). The fix imports strings and fmt and adds path prefix validation, rejecting entries whose cleaned destination escapes the extraction root.

Attack Vector

Exploitation requires that the attacker first compromise the object-storage backend that Velero uses for backups, and that a user then perform a restore operation. The attack does not require credentials to the Kubernetes API server or to Velero itself; it abuses the trust boundary between Velero and its storage backend.

// Patched imports in pkg/archive/extractor.go
 import (
 	"archive/tar"
 	"compress/gzip"
+	"fmt"
 	"io"
 	"path/filepath"
+	"strings"
 
 	"github.com/sirupsen/logrus"
 )

Source: Velero commit 3f8e358 and Velero commit c7fa4bf. The patch adds prefix checks to reject archive entries whose resolved paths fall outside the target directory.

Detection Methods for CVE-2026-32637

Indicators of Compromise

Backup tarball entries containing ../ sequences or absolute paths in the Name header of tar records.
Unexpected modifications to files inside the Velero pod filesystem, particularly under /plugins, /scratch, or Velero configuration paths.
Restore operations sourced from backup objects not created by the current Velero deployment.
Object-storage write events from principals outside the Velero controller's expected identity.

Detection Strategies

Inspect archive contents before restore using tar -tzf backup.tar.gz and reject any path containing .. or leading /.
Enable object-storage audit logs (S3 CloudTrail, Azure Storage diagnostic logs, GCS audit logs) and alert on writes to the Velero bucket from unexpected identities.
Monitor the Velero pod's filesystem for integrity drift on binaries and configuration directories after restore operations.

Monitoring Recommendations

Forward Velero controller logs and Kubernetes audit logs to a centralized data lake for correlation with backend storage events.
Alert on Velero Restore custom resources referencing backups whose provenance cannot be verified.
Track version pinning of the Velero image to confirm that patched builds are actually deployed cluster-wide.

How to Mitigate CVE-2026-32637

Immediate Actions Required

Upgrade Velero to version 1.18.1 or later across every cluster where it is deployed.
Restrict write access to the backup object-storage bucket to the Velero controller's identity only.
Audit existing backup objects for tar entries containing path traversal sequences before performing any restore.
Rotate storage backend credentials if backend compromise is suspected.

Patch Information

The fix is delivered in Velero 1.18.1. Review the GitHub Security Advisory GHSA-j2g6-362q-6qc6 and the upstream commits 3f8e358 and c7fa4bf for the patched extractor logic.

Workarounds

Enforce bucket-level object ownership and IAM policies that deny writes from all principals except the Velero service account.
Enable object versioning and immutability (S3 Object Lock, Azure immutable blobs) to preserve known-good backups.
Suspend restore operations until the upgrade to 1.18.1 is confirmed in all Velero namespaces.

bash

# Upgrade Velero using the official CLI
velero version
velero install --image velero/velero:v1.18.1 --dry-run -o yaml \
  | kubectl apply -f -

# Verify the running image tag
kubectl -n velero get deploy velero \
  -o jsonpath='{.spec.template.spec.containers[0].image}'