Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability in the backup reader (backup/backends/v3/backend.py). If a malicious backup file is provided to Karapace, an attacker may exploit insufficient path validation to perform arbitrary file read on the system where Karapace is running. The issue affects deployments that use the backup/restore functionality and process backups from untrusted sources. The impact depends on the file system permissions of the Karapace process. This issue has been patched in version 6.0.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-29190 Path Traversal Vulnerability in Karapace Backup Reader Before Version 6.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29190
Post summary
A path traversal vulnerability (CVE‑2026‑29190) affecting Karapace Backup Reader versions prior to 6.0.0 is disclosed, with technical details but no PoC, patches, or exploitation evidence.
CVE-2026-29190 Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability in the backup reader (bac… https://www.cve.org/CVERecord?id=CVE-2026-29190
Post summary
The message announces a Path Traversal vulnerability in Karapace versions prior to 6.0.0, providing basic technical detail but no exploitation, PoC, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | aiven | karapace | - | - | - |