Vulnerability Details CVE-2026-40090
Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a user-controlled output directory with the package's Metadata.Name field read directly from the untrusted package's zarf.yaml manifest. Although Metadata.Name is validated against a regex on package creation, an attacker can unarchive a package to modify the Metadata.Name field to contain path traversal sequences such as ../../etc/cron.d/malicious or absolute paths like /home/user/.ssh/authorized_keys, along with the corresponding files inside SBOMS.tar. This allows writing attacker-controlled content to arbitrary filesystem locations within the permissions of the user running the inspect command. This issue has been fixed in version 0.74.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 14.9%
CVSS Severity
CVSS v3 Score 7.1
References
Products affected by CVE-2026-40090
-
cpe:2.3:a:lfprojects:zarf:0.23.0
-
cpe:2.3:a:lfprojects:zarf:0.23.1
-
cpe:2.3:a:lfprojects:zarf:0.23.2
-
cpe:2.3:a:lfprojects:zarf:0.23.3
-
cpe:2.3:a:lfprojects:zarf:0.23.4
-
cpe:2.3:a:lfprojects:zarf:0.23.5
-
cpe:2.3:a:lfprojects:zarf:0.23.6
-
cpe:2.3:a:lfprojects:zarf:0.24.0
-
cpe:2.3:a:lfprojects:zarf:0.24.1
-
cpe:2.3:a:lfprojects:zarf:0.24.2
-
cpe:2.3:a:lfprojects:zarf:0.24.3
-
cpe:2.3:a:lfprojects:zarf:0.25.0
-
cpe:2.3:a:lfprojects:zarf:0.25.1
-
cpe:2.3:a:lfprojects:zarf:0.25.2
-
cpe:2.3:a:lfprojects:zarf:0.26.0
-
cpe:2.3:a:lfprojects:zarf:0.26.1
-
cpe:2.3:a:lfprojects:zarf:0.26.2
-
cpe:2.3:a:lfprojects:zarf:0.26.3
-
cpe:2.3:a:lfprojects:zarf:0.26.4
-
cpe:2.3:a:lfprojects:zarf:0.27.0
-
cpe:2.3:a:lfprojects:zarf:0.27.1
-
cpe:2.3:a:lfprojects:zarf:0.28.0
-
cpe:2.3:a:lfprojects:zarf:0.28.1
-
cpe:2.3:a:lfprojects:zarf:0.28.2
-
cpe:2.3:a:lfprojects:zarf:0.28.3
-
cpe:2.3:a:lfprojects:zarf:0.28.4
-
cpe:2.3:a:lfprojects:zarf:0.29.0
-
cpe:2.3:a:lfprojects:zarf:0.29.1
-
cpe:2.3:a:lfprojects:zarf:0.29.2
-
cpe:2.3:a:lfprojects:zarf:0.30.0
-
cpe:2.3:a:lfprojects:zarf:0.30.1
-
cpe:2.3:a:lfprojects:zarf:0.31.0
-
cpe:2.3:a:lfprojects:zarf:0.31.1
-
cpe:2.3:a:lfprojects:zarf:0.31.2
-
cpe:2.3:a:lfprojects:zarf:0.31.3
-
cpe:2.3:a:lfprojects:zarf:0.31.4
-
cpe:2.3:a:lfprojects:zarf:0.32.0
-
cpe:2.3:a:lfprojects:zarf:0.32.1
-
cpe:2.3:a:lfprojects:zarf:0.32.2
-
cpe:2.3:a:lfprojects:zarf:0.32.3
-
cpe:2.3:a:lfprojects:zarf:0.32.4
-
cpe:2.3:a:lfprojects:zarf:0.32.5
-
cpe:2.3:a:lfprojects:zarf:0.32.6
-
cpe:2.3:a:lfprojects:zarf:0.33.0
-
cpe:2.3:a:lfprojects:zarf:0.33.1
-
cpe:2.3:a:lfprojects:zarf:0.33.2
-
cpe:2.3:a:lfprojects:zarf:0.34.0
-
cpe:2.3:a:lfprojects:zarf:0.35.0
-
cpe:2.3:a:lfprojects:zarf:0.36.0
-
cpe:2.3:a:lfprojects:zarf:0.36.1
-
cpe:2.3:a:lfprojects:zarf:0.37.0
-
cpe:2.3:a:lfprojects:zarf:0.38.0
-
cpe:2.3:a:lfprojects:zarf:0.38.1
-
cpe:2.3:a:lfprojects:zarf:0.38.2
-
cpe:2.3:a:lfprojects:zarf:0.38.3
-
cpe:2.3:a:lfprojects:zarf:0.39.0
-
cpe:2.3:a:lfprojects:zarf:0.40.0
-
cpe:2.3:a:lfprojects:zarf:0.40.1
-
cpe:2.3:a:lfprojects:zarf:0.41.0
-
cpe:2.3:a:lfprojects:zarf:0.42.0
-
cpe:2.3:a:lfprojects:zarf:0.42.1
-
cpe:2.3:a:lfprojects:zarf:0.42.2
-
cpe:2.3:a:lfprojects:zarf:0.43.0
-
cpe:2.3:a:lfprojects:zarf:0.43.1
-
cpe:2.3:a:lfprojects:zarf:0.44.0
-
cpe:2.3:a:lfprojects:zarf:0.45.0
-
cpe:2.3:a:lfprojects:zarf:0.46.0
-
cpe:2.3:a:lfprojects:zarf:0.47.0
-
cpe:2.3:a:lfprojects:zarf:0.48.0
-
cpe:2.3:a:lfprojects:zarf:0.48.1
-
cpe:2.3:a:lfprojects:zarf:0.49.0
-
cpe:2.3:a:lfprojects:zarf:0.49.1
-
cpe:2.3:a:lfprojects:zarf:0.50.0
-
cpe:2.3:a:lfprojects:zarf:0.51.0
-
cpe:2.3:a:lfprojects:zarf:0.52.0
-
cpe:2.3:a:lfprojects:zarf:0.52.1
-
cpe:2.3:a:lfprojects:zarf:0.53.0
-
cpe:2.3:a:lfprojects:zarf:0.54.0
-
cpe:2.3:a:lfprojects:zarf:0.55.0
-
cpe:2.3:a:lfprojects:zarf:0.55.1
-
cpe:2.3:a:lfprojects:zarf:0.55.2
-
cpe:2.3:a:lfprojects:zarf:0.55.3
-
cpe:2.3:a:lfprojects:zarf:0.55.4
-
cpe:2.3:a:lfprojects:zarf:0.55.5
-
cpe:2.3:a:lfprojects:zarf:0.55.6
-
cpe:2.3:a:lfprojects:zarf:0.56.0
-
cpe:2.3:a:lfprojects:zarf:0.57.0
-
cpe:2.3:a:lfprojects:zarf:0.58.0
-
cpe:2.3:a:lfprojects:zarf:0.59.0
-
cpe:2.3:a:lfprojects:zarf:0.60.0
-
cpe:2.3:a:lfprojects:zarf:0.61.0
-
cpe:2.3:a:lfprojects:zarf:0.61.1
-
cpe:2.3:a:lfprojects:zarf:0.61.2
-
cpe:2.3:a:lfprojects:zarf:0.62.0
-
cpe:2.3:a:lfprojects:zarf:0.63.0
-
cpe:2.3:a:lfprojects:zarf:0.64.0
-
cpe:2.3:a:lfprojects:zarf:0.65.0
-
cpe:2.3:a:lfprojects:zarf:0.65.1
-
cpe:2.3:a:lfprojects:zarf:0.66.0
-
cpe:2.3:a:lfprojects:zarf:0.67.0
-
cpe:2.3:a:lfprojects:zarf:0.68.0
-
cpe:2.3:a:lfprojects:zarf:0.68.1
-
cpe:2.3:a:lfprojects:zarf:0.69.0
-
cpe:2.3:a:lfprojects:zarf:0.70.0
-
cpe:2.3:a:lfprojects:zarf:0.70.1
-
cpe:2.3:a:lfprojects:zarf:0.71.0
-
cpe:2.3:a:lfprojects:zarf:0.71.1
-
cpe:2.3:a:lfprojects:zarf:0.72.0
-
cpe:2.3:a:lfprojects:zarf:0.73.0
-
cpe:2.3:a:lfprojects:zarf:0.73.1