CVE-2026-73851

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7
https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268
https://github.com/microsoft/kiota/issues/7912
https://github.com/microsoft/kiota/pull/7910
https://github.com/microsoft/kiota/pull/7913
https://github.com/microsoft/kiota/releases/tag/v1.29.1
https://github.com/microsoft/kiota/releases/tag/v1.34.0
https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-17 15:16

Updated : 2026-08-17 16:17

NVD link : CVE-2026-73851

Mitre link : CVE-2026-73851

CVE.ORG link : CVE-2026-73851

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2026-73851", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73851", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T15:26:24.544956Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "microsoft", "product": "kiota", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.34.0"}, {"status": "affected", "version": "< 1.29.1"}]}]}], "published": "2026-08-17T15:16:57.980", "references": [{"url": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/issues/7912", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/pull/7910", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/pull/7913", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.29.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.34.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77", "source": "security-advisories@github.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0."}], "lastModified": "2026-08-17T16:17:47.677", "sourceIdentifier": "security-advisories@github.com"}