velero
v1.18.4Backup and migrate Kubernetes applications and their persistent volumes
- Maintenance
- Active271 commits in 3 months · bus factor 4
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 4 advisories4 medium · Scorecard 7.2/10
- Supported versions
- No scheduleendoflife.date does not track this project
10.4k stars · 1.6k forks · 814 open issues · last release 1 month ago · data checked 5 hours ago
Security advisories
All advisories on GitHubThe 4 most recent advisories published by the maintainers: 4 medium. Check the patched version against the one you run.
- mediumGHSA-vrfp-2x59-hcfmSep 28, 2026Shared backendStores singletons mutated under per-repo lock causing cross-BSL data/credential leakage
- Affected
- <v1.18.3
- Patched in
- v1.18.3
- mediumGHSA-8gv3-c356-fw76Sep 28, 2026Backup sync controller re-executes object-store backups with attacker-controlled exec hooks
- Affected
- <v1.18.3
- Patched in
- v1.18.3
- mediumCVE-2026-32637Aug 19, 2026File path traversal when extracting from backup's tarball
- Affected
- < 1.18.1
- mediumCVE-2020-3996Oct 21, 2020Restored PersistentVolumes may be bound to wrong PersistentVolumeClaims
- Affected
- v0.*, v1.*
- Patched in
- v1.4.3, v1.5.2