CVE-2026-29064: Symlink Vulnerability in Zarf

The core of this vulnerability lies in Zarf's insufficient validation of symlink targets within archives. An attacker could craft a malicious archive containing symlinks that, when extracted, would overwrite or create files in unexpected locations on the system. This could lead to arbitrary code execution if the attacker can control the content of the archive and the target system has appropriate permissions. The potential impact extends beyond simple file modification; a successful exploit could allow an attacker to compromise the entire Kubernetes cluster managed by Zarf, leading to data breaches, denial of service, or complete system takeover. This vulnerability is particularly concerning given Zarf's role in deploying and managing applications within Kubernetes environments.

1. Reserved2026-03-03
2. Published2026-03-10
3. Modified2026-03-23
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-29064 is to immediately upgrade Zarf to version 0.73.1 or later. This version includes the necessary validation checks to prevent the exploitation of symlink targets. If upgrading is not immediately feasible, consider restricting write access to the Zarf deployment directory to only authorized users and processes. Implement strict file integrity monitoring to detect any unauthorized modifications. While not a complete solution, these measures can reduce the attack surface and provide early warning signs of compromise. After upgrading, verify the fix by attempting to extract a known malicious archive containing symlink exploits and confirming that the extraction fails with an appropriate error message.