Arbitrary File Write Vulnerability in Zarf Package Manager for Kubernetes

CVE-2026-40090

What is CVE-2026-40090?

Zarf, an Airgap Native Packager Manager for Kubernetes, suffers from an arbitrary file write vulnerability in versions 0.23.0 through 0.74.1. This flaw arises in the 'zarf package inspect sbom' and 'zarf package inspect documentation' subcommands, where user-controlled inputs combined with untrusted package metadata can be exploited. Attackers are able to alter the 'Metadata.Name' field in the zarf.yaml manifest to insert path traversal sequences or absolute paths. Consequently, this loophole allows unauthorized write access to critical filesystem locations based on the permissions of the user executing the inspect command. This issue was rectified in version 0.74.2.

References