Aiven-Open Karapace vulnerabilities

CVE-2025-61673 [HIGH] CWE-288 CVE-2025-61673: Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0. Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read

CVE-2026-29190 [MEDIUM] CWE-22 CVE-2026-29190: Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability in the backup reader (backup/backends/v3/backend.py). If a malicious backup file is provided to Karapace, an attacker may exploit insufficient path validation to perform arbitrary file read on the system where K