Description
Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in information leakage to unauthorized users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Velero | Velero versions 0.* and 1.* prior to 1.4.3 and 1.5.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | velero | 1.6.3-1.2 | openSUSE-SU-2024:11494-1 |
Advisories 1
- openSUSE-SU-2024:11494-1 velero-1.6.3-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026