CVE-2026-54250: K3s etcd Snapshot Path Traversal Vulnerability

Technical summary

The vulnerability exists in K3s's etcd snapshot decompression logic, which fails to properly validate the paths of archive members within zip files before extracting them. When processing a snapshot restore operation, an attacker can craft zip entries with names containing path traversal sequences (e.g., '../') that bypass directory boundary checks. During decompression, these entries are extracted to arbitrary filesystem locations with the privileges of the process performing the restore. The issue affects K3s versions prior to 1.35.3+k3s1, 1.34.6+k3s1, and v1.33.10+k3s1. The vulnerability is rooted in improper input validation (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) and requires local access plus administrative intervention to trigger.

Business impact

For organizations running K3s clusters, this vulnerability poses a data integrity and system stability risk. A compromised or malicious etcd snapshot—whether introduced through a supply chain compromise, insider threat, or social engineering—can corrupt or overwrite critical system files, leading to cluster instability, loss of control plane functionality, or exposure of sensitive cluster configuration. The need for administrator involvement and local access limits the exposure window, but the impact on cluster availability and integrity is significant enough to warrant timely remediation.

Affected systems

K3s versions prior to 1.35.3+k3s1, 1.34.6+k3s1, and v1.33.10+k3s1 are affected. Organizations should verify their deployed K3s version. The vulnerability is triggered during etcd snapshot restore operations, so exposure is limited to environments actively managing K3s backups and restores.

Exploitability

Exploiting this vulnerability requires an attacker to provide a maliciously crafted zip-based etcd snapshot and have an administrator initiate a restore operation. The barrier to exploitation is moderate: while an attacker cannot remotely trigger the restore, they can influence which snapshot is used (e.g., via a compromised backup repository, social engineering, or insider access). The CVSS score of 5.8 reflects local-only attack vector and high-privilege requirement, but the user interaction dependency and high impact weighting reflect the actual risk.

Remediation

Update K3s to a patched version: 1.35.3+k3s1, 1.34.6+k3s1, or v1.33.10+k3s1 or later. Organizations should also audit recent etcd snapshot restore operations and verify the integrity of the files written to the filesystem during those operations. Additionally, implement controls to restrict who can trigger restore operations and validate the provenance of snapshot files before restoration.

Patch guidance

Apply the appropriate patched version for your release line. For K3s 1.35.x users, upgrade to 1.35.3+k3s1 or later. For 1.34.x deployments, update to 1.34.6+k3s1 or later. For 1.33.x environments, move to v1.33.10+k3s1 or later. Consult the K3s release notes and your vendor advisory for specific upgrade procedures. Plan patching during a maintenance window to avoid cluster disruption.

Detection guidance

Monitor etcd snapshot restore operations in your K3s clusters. Log and alert on any restore job initiation, especially those restoring from external or untrusted sources. Review filesystem audit logs (if enabled) for unexpected file writes outside the normal etcd data directory during or shortly after snapshot restore operations. Check for files with suspicious paths or ownership changes in system directories. Organizations can also scan snapshot files before restoration using zip inspection tools to look for entries containing '../' or absolute paths.

Why prioritize this

Although the CVSS score is MEDIUM (5.8), this vulnerability warrants prompt but measured attention. It is not widely exploitable in the wild and requires administrative action to trigger, which limits immediate risk. However, organizations with active K3s deployments and regular backup/restore practices should prioritize patching to prevent potential cluster compromise through a tangible supply chain or operational security lapse. The fact that it is not on the CISA KEV list reflects this moderate real-world urgency.

Risk score, explained

The CVSS 3.1 score of 5.8 (MEDIUM) reflects: local attack vector (AV:L) limiting remote exploitation; low attack complexity (AC:L) meaning a straightforward malicious zip file is sufficient; high privilege requirement (PR:H) constraining the set of potential triggers; and user interaction (UI:R) since an administrator must manually initiate the restore. The impact is high for integrity (I:H) and availability (A:H), but not confidentiality, because file corruption and system file overwrites can degrade cluster function and stability. The overall rating balances the real but bounded risk profile.

Frequently asked questions