CVE-2026-35171

Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:kedro:*:*:*:*:*:python:*:*

History

No history.

Information

Published : 2026-04-06 18:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-35171

Mitre link : CVE-2026-35171

CVE.ORG link : CVE-2026-35171

JSON object : View

Products Affected

linuxfoundation

kedro

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-35171", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35171", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T15:07:48.767240Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kedro-org", "product": "kedro", "versions": [{"status": "affected", "version": "< 1.3.0"}]}]}], "published": "2026-04-06T18:16:43.373", "references": [{"url": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0."}, {"lang": "es", "value": "Kedro es una caja de herramientas para ciencia de datos lista para producci\u00f3n. Antes de la versi\u00f3n 1.3.0, Kedro permite que la ruta del archivo de configuraci\u00f3n de registro se establezca a trav\u00e9s de la variable de entorno KEDRO_LOGGING_CONFIG y la carga sin validaci\u00f3n. El esquema de configuraci\u00f3n de registro admite la clave especial (), que permite la instanciaci\u00f3n arbitraria de elementos invocables. Un atacante puede explotar esto para ejecutar comandos de sistema arbitrarios durante el inicio de la aplicaci\u00f3n. Esta es una vulnerabilidad cr\u00edtica de ejecuci\u00f3n remota de c\u00f3digo (RCE) causada por el uso inseguro de logging.config.dictConfig() con entrada controlada por el usuario. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.3.0."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:kedro:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "24F97BC8-D0B5-4D19-A22A-81F2A4FDED0E", "versionEndExcluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}