CVE-2026-73851: Path Traversal
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiotato a version that resolves this vulnerability.Fixed in 1.29.1 - Upgrade
Upgrade
Kiotato a version that resolves this vulnerability.Fixed in 1.34.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73851?
The severity of CVE-2026-73851 is medium with a score of 6.1.
What type of vulnerability is CVE-2026-73851?
CVE-2026-73851 is classified as a Path Traversal vulnerability.
How do I fix CVE-2026-73851?
To fix CVE-2026-73851, update Kiota to version 1.29.1 or later, or version 1.34.0 or later.
What are the potential impacts of CVE-2026-73851?
An attacker exploiting CVE-2026-73851 could access sensitive files on the server by providing manipulated OpenAPI descriptions.
Which software is affected by CVE-2026-73851?
CVE-2026-73851 affects the Kiota OpenAPI based HTTP Client code generator.