PT-2026-23862 · Karapace · Karapace

3Th1Cyuk1 · Published 2026-03-07 · Updated 2026-03-11 · CVE-2026-29190

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Karapace versions prior to 6.0.0

Description Karapace is an implementation of Kafka REST and Schema Registry. A path traversal flaw exists in the backup reader (backup/backends/v3/backend.py) in versions before 6.0.0. An attacker providing a malicious backup file may exploit inadequate path validation to read arbitrary files on the system running Karapace. This impacts deployments utilizing the backup/restore functionality with backups from untrusted sources. The extent of the impact is determined by the file system permissions of the Karapace process.

Recommendations Update to version 6.0.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-29190

GHSA-RW4J-P3JG-4FXQ

Affected Products

Karapace

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29190.json · Exploit
• https://github.com/Aiven-Open/karapace/security/advisories/GHSA-rw4j-p3jg-4fxq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29190 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29190 · Vendor Advisory
• https://github.com/Aiven-Open/karapace/releases/tag/6.0.0 · Note
• https://twitter.com/VulmonFeeds/status/2030362871570247691 · Twitter Post
• https://t.me/cveNotify/154601 · Telegram Post
• https://t.me/cveNotify/155122 · Telegram Post
• https://twitter.com/CVEnew/status/2030339304837497050 · Twitter Post