CVE-2026-29190
📋 TL;DR
CVE-2026-29190 is a path traversal vulnerability in Karapace's backup reader that allows arbitrary file read when processing malicious backup files. This affects deployments using backup/restore functionality with untrusted backup sources. The impact depends on the Karapace process's file system permissions.
💻 Affected Systems
- Karapace
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could read sensitive system files (e.g., /etc/passwd, SSH keys, configuration files) leading to credential theft, privilege escalation, or further system compromise.
Likely Case
Limited file read based on Karapace process permissions, potentially exposing application configuration, logs, or other accessible files.
If Mitigated
No impact if backups are only processed from trusted sources or the vulnerability is patched.
🎯 Exploit Status
Exploitation requires ability to provide malicious backup files to Karapace's backup reader.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.0
Vendor Advisory: https://github.com/Aiven-Open/karapace/security/advisories/GHSA-rw4j-p3jg-4fxq
Restart Required: Yes
Instructions:
1. Upgrade Karapace to version 6.0.0 or later. 2. Restart the Karapace service. 3. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable backup processing
allTemporarily disable backup/restore functionality if not required
# Configure Karapace to disable backup endpoints or restrict access
Restrict backup sources
allOnly process backups from trusted, verified sources
# Implement source validation for backup files
🧯 If You Can't Patch
- Implement strict access controls on backup upload functionality
- Run Karapace with minimal file system permissions (least privilege principle)
🔍 How to Verify
Check if Vulnerable:
Check Karapace version and if backup functionality is enabled with untrusted source processingCheck Version:
karapace --version or check package manager (e.g., dpkg -l | grep karapace)Verify Fix Applied:
Confirm Karapace version is 6.0.0 or later and test backup processing with path traversal attempts📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in Karapace logs
- Failed path traversal attempts in backup processing logs
Network Indicators:
- Suspicious backup file uploads to Karapace endpoints
SIEM Query:
source="karapace" AND ("backup" OR "path traversal" OR "file read")