Veeam Support Knowledge Base
List of Security Fixes and Improvements in Veeam Kasten for Kubernetes

List of Security Fixes and Improvements in Veeam Kasten for Kubernetes

KB ID:	4825
Product:	Veeam Kasten for Kubernetes \| 7 \| 7.5 \| 8 \| 8.5 \| 9 Kasten K10 by Veeam \| 3 \| 5 \| 5.5 \| 6 \| 6.5
Published:	2026-03-02
Last Modified:	2026-10-23

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

Oops! Something went wrong.

Please, try again later.

Purpose

This article describes all security-related fixes and improvements introduced in each release or update of Veeam Kasten for Kubernetes.

This article aims to provide our customers' security and compliance teams with detailed information on security improvements.

Full product release notes are available here:

Veeam Kasten for Kubernetes — Release Notes

Security Fixes and Improvements

**Veeam Kasten for Kubernetes 9.0.9**

Upgraded the frontend's bundled JavaScript dependencies to resolve GHSA-g2v6-rqmx-r4w6 in @vue/server-renderer (High).
Upgraded to Go 1.27.3 to resolve CVE-2026-111943 in the Go standard library.
_{For more information review: KB4954: Mitigating Impact of Compromised eMudhra Intermediate CA Certificates on Veeam Kasten for Kubernetes.}
Also resolves 7 Medium severity CVEs in the same and other packages.

**Veeam Kasten for Kubernetes 9.0.8**

Upgraded the base image from UBI 9.8 to UBI 10.2 to resolve multiple CVEs in base OS packages:
- nginx, nginx-core and nginx-filesystem: CVE-2026-42945 (Critical); CVE-2026-27651, CVE-2026-27654, CVE-2026-27784, CVE-2026-32647, CVE-2026-42055, CVE-2026-42533, CVE-2026-60005, CVE-2026-9256 (High)
- openssl and openssl-libs: CVE-2026-84782 (High)
- pcre2 and pcre2-syntax: CVE-2026-103111, CVE-2026-86145, CVE-2026-89161 (High)
Upgraded to Go 1.27.2 to resolve CVEs in the Go standard library:
- CVE-2026-56857, CVE-2026-78663 (Critical)
- CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440, CVE-2026-94444, CVE-2026-94447, CVE-2026-97031, CVE-2026-97032 (High)
Updated golang.org/x/net to resolve CVE-2026-78663 (Critical) and CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032 (High).
Updated the frontend's bundled JavaScript dependencies to resolve CVE-2026-101898, CVE-2026-101901, CVE-2026-101903, CVE-2026-101905, CVE-2026-101906, CVE-2026-101907, CVE-2026-101909 in axios (High) and CVE-2026-93749 in source-map-js (High).
Also resolves 23 Medium and 2 Low severity CVEs in the same and other packages.

**Veeam Kasten for Kubernetes 9.0.7**

Upgraded to the latest UBI base image to resolve multiple CVEs in base OS packages:
- curl-minimal and libcurl-minimal: CVE-2026-8458, CVE-2026-8927 (High)
- expat: CVE-2026-66046, CVE-2026-93990 (High)
- libxml2: CVE-2026-74860, CVE-2026-86140 (High)
Updated the frontend's bundled JavaScript dependencies to resolve CVE-2026-85061 in maplibre-gl (Critical), CVE-2026-40345 in deepmerge-ts (High) and GHSA-36jr-mh4h-2g58 in d3-color (High).
Also resolves 8 Medium severity CVEs in the same and other packages.

**Veeam Kasten for Kubernetes 9.0.6**

Upgraded to the latest UBI base image to resolve multiple CVEs in base OS packages:
- libevent: CVE-2026-63382, CVE-2026-63383, CVE-2026-63384, CVE-2026-63385, CVE-2026-63387, CVE-2026-63388 (High)
- openssh, openssh-clients and openssh-server: CVE-2026-59999 (High)
- openssl and openssl-libs: CVE-2026-14456 (High)
- rsync: CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53790, CVE-2026-53791, CVE-2026-53793, CVE-2026-53795, CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70456, CVE-2026-70458, CVE-2026-70460, CVE-2026-70461, CVE-2026-70463, CVE-2026-70464 (High)
Also resolves 16 Medium and 6 Low severity CVEs in the same and other packages.

**Veeam Kasten for Kubernetes 9.0.5**

Upgraded to latest UBI base image to resolve multiple CVEs in base OS packages.
Updated the Go runtime to resolve additional upstream Go CVEs.
Updated the bundled Prometheus Helm chart to resolve security issues.

**Veeam Kasten for Kubernetes 9.0.4**

Upgraded to latest UBI base image to resolve multiple CVEs in base OS packages.
Patched go-ntlmssp in the Dex component to resolve CVE-2026-32952.
Updated the Go runtime and golang.org/x/mod dependency to resolve CVE-2026-56865 and additional upstream Go CVEs.

**Veeam Kasten for Kubernetes 9.0.3**

Upgraded go-git to resolve CVE-2026-71556
Upgraded the configmap-reload sidecar to resolve CVE-2026-56852
Upgraded the Prometheus base image to resolve GHSA-hrxh-6v49-42gf - GitHub Advisory
Upgraded Dex image dependencies to resolve multiple Critical and High CVEs

**Veeam Kasten for Kubernetes 9.0.2**

Upgraded to the latest UBI base image to resolve multiple CVEs.
Updated third-party dependencies (gomplate, logger base image) in the dex and logger components to address known vulnerabilities.

**Veeam Kasten for Kubernetes 9.0.1**

Upgraded to Go 1.26.5 to resolve CVE-2026-39822 & CVE-2026-42505
Updated the UBI minimal base image to incorporate the latest security fixes.
Improved logging security for Veeam Backup & Replication API credentials and other sensitive values previously written to Kasten logs.
- It is recommended to upgrade Veeam Kasten and to refresh the token by manually logging out.
Upgraded components of Kasten's bundled Prometheus monitoring stack to resolve multiple CVEs

**Veeam Kasten for Kubernetes 8.5.13**

Updated base images used in the Red Hat Marketplace operator bundle to fix multiple Critical and High CVEs

**Veeam Kasten for Kubernetes 8.5.12**

Upgraded to the latest UBI base image to resolve CVE-2026-45186 and CVE-2026-45447
Upgraded to Go 1.26.4 to resolve CVE-2026-42504
Kasten Multi-cluster Permissions: Hardened multi-cluster security by tightening the permissions granted to the impersonation `ClusterRole` on managed secondary clusters and removing sensitive token values from debug logs.

**Veeam Kasten for Kubernetes 8.5.10**

Upgraded to latest UBI base image to resolve CVE-2026-40356 and CVE-2026-4878
Immutability regression in Kasten 8.5.1–8.5.9 (S3 / GCS / Azure)
Newly written backup objects were not stamped with a retain-until date at write time and remained deletable until the Blob Lifecycle Manager applied protection on its next refresh cycle. A user, script, or attacker with bucket delete permissions could permanently delete those objects during this window, potentially rendering the affected restore points unrecoverable.

Mitigation: Configure a bucket-level Default Object Lock retention so the object store stamps new objects at write time, or upgrade to Kasten 8.5.10.

**Veeam Kasten for Kubernetes 8.5.5**

Upgrade to Go 1.26.1 to address CVE-2026-25679 and CVE-2026-27142
Updated the UBI base image to address CVE-2026-4111

**Veeam Kasten for Kubernetes 8.5.3**

Upgrade to Go 1.25.7 to address CVE-2025-61732.

**Veeam Kasten for Kubernetes 8.5.2**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.5.1**

Upgrade to Go 1.25.6 to address CVEs:
Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.15**

Upgrade to Go 1.25.5 to address CVE-2025-61727 and CVE-2025-61729.
Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.14**

Improved logging security for specific block mode datamover upload Pod invocations. It is recommended to upgrade Veeam Kasten to get this fix.

**Veeam Kasten for Kubernetes 8.0.13**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.11**

Upgrade to Go 1.25.3 to mitigate security vulnerabilities.
Upgrade to golang.org/x/net@v0.46.0 to address CVE-2025-58190 and CVE-2025-47911.
Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.10**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.8**

Upgrade to Go 1.24.7 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 8.0.7**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.6**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.24.6 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 8.0.5**

Increased the security of the generated backup repository passwords.
Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.4**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.24.5 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 8.0.3**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.2**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.24.4 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 8.0.1**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.24.3 to mitigate CVE-2025-22873.

**Veeam Kasten for Kubernetes 8.0.0**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.5.9**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.23.8 to mitigate CVE-2025-22871.

**Veeam Kasten for Kubernetes 7.5.8**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.5.5**

Upgrade to Go 1.23.7 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 7.5.4**

Update K10 services base image to pull in latest security updates.
Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.23.6 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 7.5.3**

Upgraded Prometheus to chart version v26.1.0 to pull in latest security updates.
Update K10 services base image to pull in latest security updates.
Redacted sensitive information in Kasten logging.

**Veeam Kasten for Kubernetes 7.5.2**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.5.1**

Basic users are now restricted from viewing application details of applications in other namespaces.
Basic users now require specific permission to view each action type through the Veeam Kasten dashboard.
Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.5.0**

Improved algorithm for authentication cookie validation in OIDC mode. All the users will need to re-login.

**Veeam Kasten for Kubernetes 7.0.14**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.13**

Update Grafana version to 8.5.8 to pull in the latest security updates.
Upgraded Prometheus chart version to 25.28.0 to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.10**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.9**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.8**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.6**

Fixed critical authentication vulnerability. This upgrade is recommended for all users.

**Veeam Kasten for Kubernetes 7.0.5**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.4**

Upgrade Fluent Bit to mitigate CVE-2024-4323.
Upgrade to Go 1.22.5 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 7.0.2**

Upgrade Python packages to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.1**

Upgrade to Go 1.22.4 to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.0**

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.14

Limited the scope of infrastructure credentials to improve security posture.
Upgrade to Go 1.22.3 to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.13

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.11

Upgraded to Go v1.21.9 to mitigate security vulnerabilities.

Kasten K10 by Veeam 6.5.9

Users are now restricted from listing actions in namespaces without proper authorization. All customers are encouraged to upgrade to get the fix for this issue.

Kasten K10 by Veeam 6.5.7

Upgraded google.golang.org/protobuf to mitigate CVE-2024-24786.
Upgraded to Go v1.21.8 to mitigate security vulnerabilities.
Changes in SecurityContextConstraints resource were made to reflect the latest securityContext updates on K10 workloads.
Explicitly set runAsNonRoot=true, seccompProfile=RuntimeDefault, allowPrivilegeEscalation=false and capabilities.drop=["ALL"] for K10 service containers.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.4

Explicitly set runAsNonRoot=true, seccompProfile=RuntimeDefault, allowPrivilegeEscalation=false and capabilities.drop=["ALL"] for K10 service containers.
Users are now restricted from restoring data without proper authorization. All customers are encouraged to upgrade to get the fix for this issue.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.3

Improve logging to prevent logging of sensitive backup location connection details.

Kasten K10 by Veeam 6.5.2

Upgrade golang.org/x/crypto to mitigate security vulnerability CVE-2023-48795.
Updates dependencies to address security vulnerabilities in 3rd party libraries.

Kasten K10 by Veeam 6.5.1

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.0

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.0.10

Upgrade to Go v1.21.3 to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.0.8

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.0.7

Upgrade to Go 1.20.8 to mitigate security vulnerabilities.

Kasten K10 by Veeam 6.0.5

Upgrade golang.org/x/net to v0.13.0 to mitigate CVE-2023-3978.
Upgrade to Go 1.20.7 to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.0.3

Updates emissary's Go dependencies to address security vulnerabilities.
Upgrade to Go 1.20.6 to mitigate security vulnerabilities.

Kasten K10 by Veeam 6.0.2

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.11

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.9

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.7

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.6

Upgrade to Go 1.19.6 to mitigate security vulnerabilities.

Kasten K10 by Veeam 5.5.5

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.4

Basic users are now restricted from using transforms in RestoreActions.

Kasten K10 by Veeam 5.5.3

It is now possible to prevent basic users from creating ImportActions or RestoreActions. In some multi-tenant environments, these actions should only be available to administrators.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.2

Upgrade to Go 1.19.4 to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.1

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.0

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.0.11

Upgrade Dex image to mitigate security vulnerabilities.
Upgrade to Go 1.19.2 to mitigate security vulnerabilities.

Kasten K10 by Veeam 5.0.9

Update Grafana version to 9.1.5 to pull in the latest security updates.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.0.8

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.0.5

Update K10 services base image to pull in latest security updates.
Update Emissary Ingress to 3.1.0 to include latest security updates.

Kasten K10 by Veeam 5.0.3

Upgrade to Go 1.17.12 to include the latest security patches.

Kasten K10 by Veeam 5.0.2

Update K10 services base image to pull in latest security updates.
Update Emissary Ingress (Ambassador) to 3.0.0 to include latest security updates.

Kasten K10 by Veeam 5.0.0

Upgrade to Go 1.17.10 to include the latest security patches.

Kasten K10 by Veeam 4.5.15

Update Grafana version to 8.5.0 to pull in the latest security updates.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.5.13

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.5.12

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.5.11

Update Ambassador to 1.14.3 to include latest security updates.

Kasten K10 by Veeam 4.5.10

Upgrade to Go 1.17.7 to mitigate CVE-2022-23772 and CVE-2022-23806.

Kasten K10 by Veeam 4.5.9

Fix CVE-2021-23017 discovered in the previous nginx versions.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.5.7

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.5.6

Update Grafana version to pull in fix for CVE-2021-43798.

Kasten K10 by Veeam 4.5.2

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.13

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.10

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.9

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.6

Fix proxy requests to secondary clusters to be restricted to the secondary cluster.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.5

Update Go to pull in latest security fixes.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.4

Update Ambassador to 1.13.6 to include latest security updates.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.3

Upgrade golang.org/x/net prevent denial of service (CVE-2021-33194).

Kasten K10 by Veeam 4.0.2

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 3.0.13

Update Ambassador version to pull in security fixes in Envoy 1.15.4

Kasten K10 by Veeam 3.0.1

Mitigate potential crashes caused by malicious certificates.

Kasten K10 by Veeam 2.5.14

Module upgrades to address CVE-2020-14040.
Upgraded Ambassador to incorporate the Envoy 1.14.3 security update.

Kasten K10 by Veeam 2.5.12

When K10 is deployed with OIDC, user-initiated actions (via the API, CLI, or the dashboard) will be attributed to the user instead of the K10 service account.

Kasten K10 by Veeam 2.5.9

Upgraded several JavaScript packages to address recently disclosed CVEs.

More Information

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.