CVE-2020-3996

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-22 · updated 2026-06-17

Description

Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in information leakage to unauthorized users.

Affected products

Velero: before 1.4.3; from 1.5.0 before 1.5.2 — fixed in 1.4.3, 1.5.2
Velero: from Velero versions 0.* and 1.* prior through 1.4.3 and 1.5.2

How to fix

Upgrade to a fixed version: Velero 1.4.3, 1.5.2. Check the vendor advisory for mitigations.

References

https://github.com/vmware-tanzu/velero/security/advisories/GHSA-72xg-3mcq-52v4
https://github.com/vmware-tanzu/velero/security/advisories/GHSA-72xg-3mcq-52v4

Get alerted when CVE-2020-3996 or the next vulnerability affects your stack