CVE-2026-29190 Details

A path traversal vulnerability has been identified in Karapace, an open-source implementation of Kafka REST and Schema Registry, prior to version 6.0.0. The issue resides in the backup reader component, specifically in the file backup/backends/v3/backend.py. This vulnerability allows an attacker to exploit inadequate path validation in a malicious backup file, leading to arbitrary file read on the system where Karapace is running. The vulnerability affects deployments that utilize the backup/restore functionality and handle backups from untrusted sources. The impact of this vulnerability varies based on the file system permissions of the Karapace process.

Users are advised to upgrade to Karapace version 6.0.0 or later, as the backup functionality has been removed in this version. If an immediate upgrade is not possible, users should only restore backups from trusted sources, run Karapace with least-privilege permissions, restrict file system access, pre-validate backup archives to reject paths containing '../' or absolute paths, and avoid mounting sensitive host paths.