CVE-2026-36500: An issue in the cluster-admin:backup-datastore component of Controller v12

Synopsis

A directory traversal vulnerability exists in the cluster-admin:backup-datastore component of Controller v12.0.5. The flaw is reachable over the network without any authentication, by sending a crafted request that manipulates file path references to step outside the intended directory boundary. Successful exploitation gives an attacker the ability to read arbitrary files from the host filesystem and disrupt service availability. HarborGuard is tracking this advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, meaning an attacker must be able to reach the service via a network connection to send a crafted request.

• AuthenticationNot required

  No credentials or account of any kind are needed; the crafted request can be sent by any unauthenticated party.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or administrator of the affected system.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or other environmental factors to succeed.

Blast Radius

• An attacker can read arbitrary files from the host filesystem, including configuration files, credentials, private keys, and other sensitive data stored outside the intended backup-datastore directory.
• An attacker can disrupt availability of the affected Controller service, causing it to become unresponsive or fail to complete backup operations.