Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated… (CVE-2026-93853)

The vulnerability in Barman involves unverified ownership during snapshot backup deletion. When a snapshot backup is deleted, Barman reads snapshot identifiers from the backup.info file and calls the cloud provider's delete API using Barman's credentials without verifying that the snapshots belong to the backup being deleted. An attacker who can overwrite the backup.info file but lacks direct snapshot delete permissions can substitute identifiers of other snapshots, causing Barman to delete any snapshot accessible by its cloud identity on AWS, Microsoft Azure, or Google Cloud. Exploitation requires a deployment where the principal that writes the backup catalog is distinct from the identity Barman uses to delete snapshots. The affected versions include Barman 3.4.0 (Google Cloud), 3.6.0 (Azure), and 3.7.0 (AWS) through 3.20.0. The issue is resolved in version 3.20.1.

An attacker with write access to the backup catalog but without snapshot delete permissions can cause Barman to delete arbitrary cloud snapshots accessible by Barman's cloud identity. This can lead to unintended deletion of unrelated snapshots, potentially causing data loss or disruption of backup integrity across AWS, Azure, and Google Cloud environments.

A fix is available in Barman version 3.20.1. Users should upgrade to this version to resolve the vulnerability. Until upgraded, deployments should ensure that the principal writing the backup catalog and the identity used by Barman to delete snapshots are not separable or that write access to the backup catalog is tightly controlled to prevent unauthorized modification of backup.info. Patch status is confirmed fixed in 3.20.1.