CVE-2026-92791: Uber Kraken through 0.1.29 Path Traversal via tag parameter
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Uber Krakento a version that resolves this vulnerability.Fixed in 0.1.29 - Compensating control
Apply path traversal hardening for the /tags/{tag} endpoint by rejecting percent-encoded parent-directory segments (e.g., "../" and its percent-encoded forms) in the tag parameter to prevent traversal outside the configured storage root.
Event History
Frequently Asked Questions
Which releases are in scope?
Uber Kraken releases through 0.1.29 are affected.
What does an attacker need to exploit this issue?
An attacker can exploit the issue without authentication by sending a request to the /tags/{tag} endpoint with percent-encoded parent-directory segments in the tag parameter.
What data could be exposed?
The issue can expose arbitrary files outside the configured storage root, limited to files that the testfs backend process can read.