CVE-2020-3996: VMware Velero

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in information leakage to unauthorized users.

Affected products

• VMware Velero: before 1.4.3 (fixed in 1.4.3); from 1.5.0, before 1.5.2 (fixed in 1.5.2)

Published 2020-10-22. Last modified 2026-06-17.