The cluster-backup-operator contains a flaw that allows an attacker with write access to the backup storage location or who can create a Velero Backup object to inject malicious RBAC resources into a backup file. When a tampered backup is restored, the operator processes these resources, resulting in a privilege escalation from a backup-namespace-admin level to hub cluster-admin. This gives the attacker full administrative control over the cluster, compromising confidentiality, integrity and availability of all workloads.

The vulnerability impacts the cluster-backup-operator component of Velero, which is commonly used in Kubernetes clusters to perform backups and restores. Any installation that uses this operator for Velero restores is potentially affected, especially when the backup storage location is accessible to untrusted writers or when arbitrary Velero Backup objects can be created.

The CVSS score of 8.5 indicates high severity, and the vulnerability is not listed in the CISA KEV catalog. Because EPSS data is not available, the likelihood of exploitation cannot be quantified, but the attack vector is inferred to require the attacker to either write to the backup storage bucket or create a Velero Backup object. Once a malicious backup is introduced, the restore process automatically applies the injected RBAC resources, making exploitation straightforward for a knowledgeable attacker. The impact is system-wide privilege escalation, a critical risk for any cluster employing this operator.