velero-plugin-for-alicloud — security advisory

{
  "id": "b0d8597524acfe597d36f7c6e2ccd1d25bdff550308801a1c69fea45c887bfe5",
  "url": "https://osv.dev/vulnerability/CGA-p8cq-7jh9-3v7p",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CGA-p8cq-7jh9-3v7p",
    "summary": "CGA-p8cq-7jh9-3v7p",
    "evidence": "osv:CGA-p8cq-7jh9-3v7p",
    "products": [
      {
        "name": {
          "value": "velero-plugin-for-alicloud",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "CGA-p8cq-7jh9-3v7p",
      "aliases": [
        "CGA-p8cq-7jh9-3v7p"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "velero-plugin-for-alicloud",
            "purl": "pkg:apk/chainguard/velero-plugin-for-alicloud?arch=aarch64",
            "ecosystem": "Chainguard"
          },
          "database_specific": {
            "source": "https://advisories.cgr.dev/chainguard/v3/osv/CGA-p8cq-7jh9-3v7p.json",
            "chainguard": {
              "applies_to_subpackages": false
            }
          },
          "ecosystem_specific": {
            "components": [
              {
                "component_name": "google.golang.org/grpc",
                "component_purl": "pkg:golang/google.golang.org/grpc@v1.26.0",
                "component_type": "go-module",
                "component_version": "v1.26.0",
                "component_location": "/usr/bin/velero-plugin-for-alibabacloud",
                "latest_event_status": "pending_upstream_fix",
                "latest_event_timestamp": "2026-10-20T18:34:29Z"
              }
            ]
          }
        }
      ],
      "modified": "2026-10-21T14:32:44.030184044Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-33186",
        "GHSA-p77j-4mvh-x3m3",
        "GO-2026-4762"
      ],
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33186.json",
        "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json",
        "https://access.redhat.com/errata/RHSA-2026:10093",
        "https://access.redhat.com/errata/RHSA-2026:10094",
        "https://access.redhat.com/errata/RHSA-2026:10105",
        "https://access.redhat.com/errata/RHSA-2026:10107",
        "https://access.redhat.com/errata/RHSA-2026:10125",
        "https://access.redhat.com/errata/RHSA-2026:10126",
        "https://access.redhat.com/errata/RHSA-2026:10130",
        "https://access.redhat.com/errata/RHSA-2026:10131",
        "https://access.redhat.com/errata/RHSA-2026:10153",
        "https://access.redhat.com/errata/RHSA-2026:10155",
        "https://access.redhat.com/errata/RHSA-2026:10158",
        "https://access.redhat.com/errata/RHSA-2026:10172",
        "https://access.redhat.com/errata/RHSA-2026:10175",
        "https://access.redhat.com/errata/RHSA-2026:10698",
        "https://access.redhat.com/errata/RHSA-2026:10705",
        "https://access.redhat.com/errata/RHSA-2026:10706",
        "https://access.redhat.com/errata/RHSA-2026:11070",
        "https://access.redhat.com/errata/RHSA-2026:11408",
        "https://access.redhat.com/errata/RHSA-2026:11803",
        "https://access.redhat.com/errata/RHSA-2026:11856",
        "https://access.redhat.com/errata/RHSA-2026:11916",
        "https://access.redhat.com/errata/RHSA-2026:11996",
        "https://access.redhat.com/errata/RHSA-2026:12116",
        "https://access.redhat.com/errata/RHSA-2026:12118",
        "https://access.redhat.com/errata/RHSA-2026:12119",
        "https://access.redhat.com/errata/RHSA-2026:12277",
        "https://access.redhat.com/errata/RHSA-2026:12279",
        "https://access.redhat.com/errata/RHSA-2026:12283",
        "https://access.redhat.com/errata/RHSA-2026:12337",
        "https://access.redhat.com/errata/RHSA-2026:13548",
        "https://access.redhat.com/errata/RHSA-2026:13791",
        "https://access.redhat.com/errata/RHSA-2026:13829",
        "https://access.redhat.com/errata/RHSA-2026:14775",
        "https://access.redhat.com/errata/RHSA-2026:15092",
        "https://access.redhat.com/errata/RHSA-2026:17123",
        "https://access.redhat.com/errata/RHSA-2026:17448",
        "https://access.redhat.com/errata/RHSA-2026:17459",
        "https://access.redhat.com/errata/RHSA-2026:17468",
        "https://access.redhat.com/errata/RHSA-2026:17474",
        "https://access.redhat.com/errata/RHSA-2026:17475",
        "https://access.redhat.com/errata/RHSA-2026:17598",
        "https://access.redhat.com/errata/RHSA-2026:17599",
        "https://access.redhat.com/errata/RHSA-2026:17789",
        "https://access.redhat.com/errata/RHSA-2026:18068",
        "https://access.redhat.com/errata/RHSA-2026:18585",
        "https://access.redhat.com/errata/RHSA-2026:19099",
        "https://access.redhat.com/errata/RHSA-2026:19108",
        "https://access.redhat.com/errata/RHSA-2026:19109",
        "https://access.redhat.com/errata/RHSA-2026:19135",
        "https://access.redhat.com/errata/RHSA-2026:19207",
        "https://access.redhat.com/errata/RHSA-2026:19353",
        "https://access.redhat.com/errata/RHSA-2026:19375",
        "https://access.redhat.com/errata/RHSA-2026:19712",
        "https://access.redhat.com/errata/RHSA-2026:19719",
        "https://access.redhat.com/errata/RHSA-2026:19720",
        "https://access.redhat.com/errata/RHSA-2026:19721",
        "https://access.redhat.com/errata/RHSA-2026:20034",
        "https://access.redhat.com/errata/RHSA-2026:20035",
        "https://access.redhat.com/errata/RHSA-2026:20041",
        "https://access.redhat.com/errata/RHSA-2026:20042",
        "https://access.redhat.com/errata/RHSA-2026:20088",
        "https://access.redhat.com/errata/RHSA-2026:20089",
        "https://access.redhat.com/errata/RHSA-2026:20322",
        "https://access.redhat.com/errata/RHSA-2026:20436",
        "https://access.redhat.com/errata/RHSA-2026:20943",
        "https://access.redhat.com/errata/RHSA-2026:20946",
        "https://access.redhat.com/errata/RHSA-2026:21017",
        "https://access.redhat.com/errata/RHSA-2026:21657",
        "https://access.redhat.com/errata/RHSA-2026:21658",
        "https://access.redhat.com/errata/RHSA-2026:21691",
        "https://access.redhat.com/errata/RHSA-2026:21692",
        "https://access.redhat.com/errata/RHSA-2026:21696",
        "https://access.redhat.com/errata/RHSA-2026:21697",
        "https://access.redhat.com/errata/RHSA-2026:21703",
        "https://access.redhat.com/errata/RHSA-2026:21704",
        "https://access.redhat.com/errata/RHSA-2026:21709",
        "https://access.redhat.com/errata/RHSA-2026:21710",
        "https://access.redhat.com/errata/RHSA-2026:21769",
        "https://access.redhat.com/errata/RHSA-2026:21931",
        "https://access.redhat.com/errata/RHSA-2026:21932",
        "https://access.redhat.com/errata/RHSA-2026:22347",
        "https://access.redhat.com/errata/RHSA-2026:22423",
        "https://access.redhat.com/errata/RHSA-2026:22450",
        "https://access.redhat.com/errata/RHSA-2026:22465",
        "https://access.redhat.com/errata/RHSA-2026:22485",
        "https://access.redhat.com/errata/RHSA-2026:22645",
        "https://access.redhat.com/errata/RHSA-2026:22689",
        "https://access.redhat.com/errata/RHSA-2026:22714",
        "https://access.redhat.com/errata/RHSA-2026:22800",
        "https://access.redhat.com/errata/RHSA-2026:22937",
        "https://access.redhat.com/errata/RHSA-2026:22959",
        "https://access.redhat.com/errata/RHSA-2026:22961",
        "https://access.redhat.com/errata/RHSA-2026:23228",
        "https://access.redhat.com/errata/RHSA-2026:23234",
        "https://access.redhat.com/errata/RHSA-2026:23235",
        "https://access.redhat.com/errata/RHSA-2026:23241",
        "https://access.redhat.com/errata/RHSA-2026:23246",
        "https://access.redhat.com/errata/RHSA-2026:23247",
        "https://access.redhat.com/errata/RHSA-2026:23345",
        "https://access.redhat.com/errata/RHSA-2026:24484",
        "https://access.redhat.com/errata/RHSA-2026:24506",
        "https://access.redhat.com/errata/RHSA-2026:24535",
        "https://access.redhat.com/errata/RHSA-2026:24536",
        "https://access.redhat.com/errata/RHSA-2026:24759",
        "https://access.redhat.com/errata/RHSA-2026:24853",
        "https://access.redhat.com/errata/RHSA-2026:24977",
        "https://access.redhat.com/errata/RHSA-2026:25009",
        "https://access.redhat.com/errata/RHSA-2026:25045",
        "https://access.redhat.com/errata/RHSA-2026:25127",
        "https://access.redhat.com/errata/RHSA-2026:25182",
        "https://access.redhat.com/errata/RHSA-2026:25183",
        "https://access.redhat.com/errata/RHSA-2026:25187",
        "https://access.redhat.com/errata/RHSA-2026:25194",
        "https://access.redhat.com/errata/RHSA-2026:25195",
        "https://access.redhat.com/errata/RHSA-2026:25201",
        "https://access.redhat.com/errata/RHSA-2026:26412",
        "https://access.redhat.com/errata/RHSA-2026:26413",
        "https://access.redhat.com/errata/RHSA-2026:26416",
        "https://access.redhat.com/errata/RHSA-2026:26420",
        "https://access.redhat.com/errata/RHSA-2026:26519",
        "https://access.redhat.com/errata/RHSA-2026:26568",
        "https://access.redhat.com/errata/RHSA-2026:26997",
        "https://access.redhat.com/errata/RHSA-2026:26999",
        "https://access.redhat.com/errata/RHSA-2026:27001",
        "https://access.redhat.com/errata/RHSA-2026:27004",
        "https://access.redhat.com/errata/RHSA-2026:27063",
        "https://access.redhat.com/errata/RHSA-2026:27076",
        "https://access.redhat.com/errata/RHSA-2026:27712",
        "https://access.redhat.com/errata/RHSA-2026:27856",
        "https://access.redhat.com/errata/RHSA-2026:27892",
        "https://access.redhat.com/errata/RHSA-2026:27893",
        "https://access.redhat.com/errata/RHSA-2026:27901",
        "https://access.redhat.com/errata/RHSA-2026:27957",
        "https://access.redhat.com/errata/RHSA-2026:28047",
        "https://access.redhat.com/errata/RHSA-2026:28893",
        "https://access.redhat.com/errata/RHSA-2026:28964",
        "https://access.redhat.com/errata/RHSA-2026:29079",
        "https://access.redhat.com/errata/RHSA-2026:29082",
        "https://access.redhat.com/errata/RHSA-2026:29854",
        "https://access.redhat.com/errata/RHSA-2026:34364",
        "https://access.redhat.com/errata/RHSA-2026:6174",
        "https://access.redhat.com/errata/RHSA-2026:6428",
        "https://access.redhat.com/errata/RHSA-2026:6564",
        "https://access.redhat.com/errata/RHSA-2026:6802",
        "https://access.redhat.com/errata/RHSA-2026:7110",
        "https://access.redhat.com/errata/RHSA-2026:7128",
        "https://access.redhat.com/errata/RHSA-2026:7245",
        "https://access.redhat.com/errata/RHSA-2026:8151",
        "https://access.redhat.com/errata/RHSA-2026:8338",
        "https://access.redhat.com/errata/RHSA-2026:8433",
        "https://access.redhat.com/errata/RHSA-2026:8449",
        "https://access.redhat.com/errata/RHSA-2026:8483",
        "https://access.redhat.com/errata/RHSA-2026:8484",
        "https://access.redhat.com/errata/RHSA-2026:8490",
        "https://access.redhat.com/errata/RHSA-2026:8491",
        "https://access.redhat.com/errata/RHSA-2026:8493",
        "https://access.redhat.com/errata/RHSA-2026:9385",
        "https://access.redhat.com/errata/RHSA-2026:9388",
        "https://access.redhat.com/errata/RHSA-2026:9440",
        "https://access.redhat.com/errata/RHSA-2026:9448",
        "https://access.redhat.com/errata/RHSA-2026:9453",
        "https://access.redhat.com/errata/RHSA-2026:9872",
        "https://access.redhat.com/security/cve/CVE-2026-33186",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2449833",
        "https://access.redhat.com/errata/RHSA-2026:34769",
        "https://access.redhat.com/errata/RHSA-2026:34794",
        "https://access.redhat.com/errata/RHSA-2026:34795",
        "https://access.redhat.com/errata/RHSA-2026:34049",
        "https://access.redhat.com/errata/RHSA-2026:34097",
        "https://access.redhat.com/errata/RHSA-2026:34099",
        "https://access.redhat.com/errata/RHSA-2026:36651",
        "https://access.redhat.com/errata/RHSA-2026:36796",
        "https://access.redhat.com/errata/RHSA-2026:36882",
        "https://access.redhat.com/errata/RHSA-2026:34100",
        "https://access.redhat.com/errata/RHSA-2026:37275",
        "https://access.redhat.com/errata/RHSA-2026:37585",
        "https://access.redhat.com/errata/RHSA-2026:37192",
        "https://access.redhat.com/errata/RHSA-2026:37580",
        "https://access.redhat.com/errata/RHSA-2026:36611",
        "https://access.redhat.com/errata/RHSA-2026:36621",
        "https://access.redhat.com/errata/RHSA-2026:40118",
        "https://access.redhat.com/errata/RHSA-2026:40984",
        "https://access.redhat.com/errata/RHSA-2026:40945",
        "https://access.redhat.com/errata/RHSA-2026:41019",
        "https://access.redhat.com/errata/RHSA-2026:40792",
        "https://access.redhat.com/errata/RHSA-2026:40795",
        "https://access.redhat.com/errata/RHSA-2026:41928",
        "https://access.redhat.com/errata/RHSA-2026:41941",
        "https://access.redhat.com/errata/RHSA-2026:41944",
        "https://access.redhat.com/errata/RHSA-2026:42049",
        "https://access.redhat.com/errata/RHSA-2026:42051",
        "https://access.redhat.com/errata/RHSA-2026:42150",
        "https://access.redhat.com/errata/RHSA-2026:42151",
        "https://access.redhat.com/errata/RHSA-2026:42240",
        "https://access.redhat.com/errata/RHSA-2026:42644",
        "https://access.redhat.com/errata/RHSA-2026:43692",
        "https://access.redhat.com/errata/RHSA-2026:40022",
        "https://access.redhat.com/errata/RHSA-2026:40030",
        "https://access.redhat.com/errata/RHSA-2026:43227",
        "https://access.redhat.com/errata/RHSA-2026:43253",
        "https://access.redhat.com/errata/RHSA-2026:44233",
        "https://access.redhat.com/errata/RHSA-2026:44235",
        "https://access.redhat.com/errata/RHSA-2026:47952",
        "https://access.redhat.com/errata/RHSA-2026:43331",
        "https://access.redhat.com/errata/RHSA-2026:43225",
        "https://access.redhat.com/errata/RHSA-2026:48790",
        "https://access.redhat.com/errata/RHSA-2026:47728",
        "https://access.redhat.com/errata/RHSA-2026:48699",
        "https://access.redhat.com/errata/RHSA-2026:50843",
        "https://access.redhat.com/errata/RHSA-2026:51033",
        "https://access.redhat.com/errata/RHSA-2026:53728",
        "https://access.redhat.com/errata/RHSA-2026:53763",
        "https://access.redhat.com/errata/RHSA-2026:53773",
        "https://access.redhat.com/errata/RHSA-2026:53804",
        "https://access.redhat.com/errata/RHSA-2026:54191",
        "https://access.redhat.com/errata/RHSA-2026:50758",
        "https://access.redhat.com/errata/RHSA-2026:54274",
        "https://access.redhat.com/errata/RHSA-2026:54286",
        "https://access.redhat.com/errata/RHSA-2026:54531",
        "https://access.redhat.com/errata/RHSA-2026:54757",
        "https://access.redhat.com/errata/RHSA-2026:56366",
        "https://access.redhat.com/errata/RHSA-2026:56431",
        "https://access.redhat.com/errata/RHSA-2026:56959",
        "https://access.redhat.com/errata/RHSA-2026:57013",
        "https://access.redhat.com/errata/RHSA-2026:56789",
        "https://access.redhat.com/errata/RHSA-2026:57365",
        "https://access.redhat.com/errata/RHSA-2026:56854",
        "https://access.redhat.com/errata/RHSA-2026:56912",
        "https://access.redhat.com/errata/RHSA-2026:60146",
        "https://access.redhat.com/errata/RHSA-2026:61245",
        "https://access.redhat.com/errata/RHSA-2026:59833"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-33186",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 393646,
  "published_at": "2026-10-20T09:38:11+00:00"
}