Bug 2507993 (CVE-2026-66798) - CVE-2026-66798 cluster-backup-operator: cluster-backup-operator: Restore.spec.hooks passed verbatim to Velero Restore — arbitrary command execution in restored pods
Summary: CVE-2026-66798 cluster-backup-operator: cluster-backup-operator: Restore.spec...
Keywords:
Status: NEW
Alias: CVE-2026-66798
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-28 13:52 UTC by OSIDB Bzimport
Modified: 2026-08-11 16:26 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-28 13:52:29 UTC 
The cluster-backup-operator copies Restore.spec.hooks.resources verbatim into the Velero Restore object's Spec.Hooks.Resources (controllers/restore.go:868-871) with no filtering or allow-list. The Velero RestoreHooks type carries PostHooks[].Exec.Command ([]string), which Velero executes inside targeted pods after restore.

The validating webhook (api/v1beta1/restore_webhook.go validateRestore(), lines 80-91) only validates sync-mode invariants (SyncRestoreWithNewBackups) and never inspects Hooks, so arbitrary postHooks exec commands pass through unchecked.

A namespace-admin in open-cluster-management-backup can create a Restore CR with malicious hooks that execute arbitrary commands in every matching restored pod, exfiltrating their ServiceAccount tokens. This is a pods/exec bypass — the attacker gains exec access to pods and SAs they would not normally be authorized to access.

Confirmed by static triage at SHA 7f488e2e and live validation (Restore CR glasswing-find-002 created successfully). Root cause not addressed at HEAD 6248fd4.
Note You need to log in before you can comment on or make changes to this bug.