Path Traversal Vulnerability in Karapace by Aiven

CVE-2026-29190

What is CVE-2026-29190?

Karapace, an open-source implementation of Kafka REST and Schema Registry, is susceptible to a Path Traversal vulnerability in its backup reader module. This issue arises when untrusted backup files are processed, allowing attackers to exploit insufficient path validation and gain unauthorized access to arbitrary files on the system running Karapace. Deployments using the backup and restore functionality are particularly at risk, and the extent of the impact is dictated by the file system permissions assigned to the Karapace process. The vulnerability has been effectively addressed in version 6.0.0.

References