Bug 2507993 (CVE-2026-66798)

Summary:	CVE-2026-66798 cluster-backup-operator: cluster-backup-operator: Restore.spec.hooks passed verbatim to Velero Restore — arbitrary command execution in restored pods
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gparvin, rhaigner, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in cluster-backup-operator. A namespace administrator in open-cluster-management-backup can create a Restore Custom Resource (CR) with malicious hooks. These hooks allow the execution of arbitrary commands within any matching restored pod, leading to the exfiltration of ServiceAccount tokens. This bypasses normal access controls, granting the attacker unauthorized execution access to pods and their associated Service Accounts.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-28 13:52:29 UTC

The cluster-backup-operator copies Restore.spec.hooks.resources verbatim into the Velero Restore object's Spec.Hooks.Resources (controllers/restore.go:868-871) with no filtering or allow-list. The Velero RestoreHooks type carries PostHooks[].Exec.Command ([]string), which Velero executes inside targeted pods after restore.

The validating webhook (api/v1beta1/restore_webhook.go validateRestore(), lines 80-91) only validates sync-mode invariants (SyncRestoreWithNewBackups) and never inspects Hooks, so arbitrary postHooks exec commands pass through unchecked.

A namespace-admin in open-cluster-management-backup can create a Restore CR with malicious hooks that execute arbitrary commands in every matching restored pod, exfiltrating their ServiceAccount tokens. This is a pods/exec bypass — the attacker gains exec access to pods and SAs they would not normally be authorized to access.

Confirmed by static triage at SHA 7f488e2e and live validation (Restore CR glasswing-find-002 created successfully). Root cause not addressed at HEAD 6248fd4.