CVE-2026-73851

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7
https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268
https://github.com/microsoft/kiota/issues/7912
https://github.com/microsoft/kiota/pull/7910
https://github.com/microsoft/kiota/pull/7913
https://github.com/microsoft/kiota/releases/tag/v1.29.1
https://github.com/microsoft/kiota/releases/tag/v1.34.0
https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Kiota es un generador de código de cliente HTTP basado en OpenAPI. Antes de las versiones 1.29.1 y 1.34.0, un atacante que controla o manipula la descripción de OpenAPI consumida por Kiota puede proporcionar una referencia de archivo que se resuelve fuera del paquete del manifiesto (por ejemplo, .. / .. / .. / .. / etc/p4ssd, una ruta absoluta o una URI file: // / http(s)://). Cuando el manifiesto generado se despliega y es consumido por un host de IA, esto puede llevar a la inclusión o divulgación de archivos fuera del límite del paquete previsto. Esta vulnerabilidad está corregida en las versiones 1.29.1 y 1.34.0.

Information

Published : 2026-08-17 15:16

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73851

Mitre link : CVE-2026-73851

CVE.ORG link : CVE-2026-73851

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2026-73851", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73851", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T15:26:24.544956Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "microsoft", "product": "kiota", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.34.0"}, {"status": "affected", "version": "< 1.29.1"}]}]}], "published": "2026-08-17T15:16:57.980", "references": [{"url": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/issues/7912", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/pull/7910", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/pull/7913", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.29.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.34.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0."}, {"lang": "es", "value": "Kiota es un generador de c\u00f3digo de cliente HTTP basado en OpenAPI. Antes de las versiones 1.29.1 y 1.34.0, un atacante que controla o manipula la descripci\u00f3n de OpenAPI consumida por Kiota puede proporcionar una referencia de archivo que se resuelve fuera del paquete del manifiesto (por ejemplo, .. / .. / .. / .. / etc/p4ssd, una ruta absoluta o una URI file: // / http(s)://). Cuando el manifiesto generado se despliega y es consumido por un host de IA, esto puede llevar a la inclusi\u00f3n o divulgaci\u00f3n de archivos fuera del l\u00edmite del paquete previsto. Esta vulnerabilidad est\u00e1 corregida en las versiones 1.29.1 y 1.34.0."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}