Aiven-Open vulnerabilities
We track 5 vulnerabilities in Aiven-Open products across 5 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest Aiven-Open vulnerabilities
- 8.4 High severity
pghoard: Improper Limitation of a Pathname to a Restricted Directory
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or
- 7.7 High severity
bigquery-connector-for-apache-kafka: External Control of File Name or Path
Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to 2.11.0, there is an arbitrary file read in Google BigQuery Sink connector. Aiven's Google BigQuery Kafka Connect Sink connector requires Go
- 7.5 High severity
myhoard: Transmission of Private Resources into a New Sphere
MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direc
- 8.6 High severity
karapace: Authentication Bypass Using an Alternate Path or Channel
Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization hea
- 7.5 High severity
journalpump: Cleartext Transmission of Sensitive Information
journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including