Read the docs
TI-2026-68448 Aliases CVE-2026-105795GHSA-6gw6-rv2g-25mg

Path traversal in API plugin manifests generated by Kiota

Priority LOW 18CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Kiota from 1.25.1 before 1.35.0 copies oauth_card_path from an OpenAPI description into generated API plugin manifests without validating it. Missing path validation (CWE-22) lets traversal sequences, rooted paths or absolute URIs reach a consuming host. An attacker who controls the OpenAPI description can make a resolving host cross the plugin package boundary or use an unintended authentication card. Kiota does not read files during generation, so impact needs a host that resolves the reference.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe package-relative file reference. Parent-directory traversal, rooted paths, or absolute URIs can therefore reach a consuming host that resolves the reference, allowing the host to cross the intended plugin-package boundary or use an unintended authentication card. Kiota does not itself read a local file or execute code merely while generating the manifest, and impact requires downstream resolution of the unsafe reference. This issue is fixed in version 1.35.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01214 68th percentileScored 2026-11-07
Fix Fixed kiota (microsoft): 1.35.0Microsoft.OpenApi.Kiota (microsoft): 1.35.0+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Microsoftkiota1.25.1 to before 1.35.01.35.0Patch availableCNA
MicrosoftMicrosoft.OpenApi.Kiota1.25.1 to before 1.35.01.35.0Patch availableCNA
MicrosoftMicrosoft.OpenApi.Kiota.Builder1.25.1 to before 1.35.01.35.0Patch availableCNA
—Microsoft.OpenApi.Kiota (NuGet)1.25.1 to before 1.35.01.35.0Patch availableGHSA-6gw6-rv2g-25mg
—Microsoft.OpenApi.Kiota.Builder (NuGet)1.25.1 to before 1.35.01.35.0Patch availableGHSA-6gw6-rv2g-25mg
  • kiota VendorMicrosoft Affected 1.25.1 to before 1.35.0 Fixed in 1.35.0 Patch available CNA
  • Microsoft.OpenApi.Kiota VendorMicrosoft Affected 1.25.1 to before 1.35.0 Fixed in 1.35.0 Patch available CNA
  • Microsoft.OpenApi.Kiota.Builder VendorMicrosoft Affected 1.25.1 to before 1.35.0 Fixed in 1.35.0 Patch available CNA
  • Microsoft.OpenApi.Kiota (NuGet) Vendor— Affected 1.25.1 to before 1.35.0 Fixed in 1.35.0 Patch available GHSA-6gw6-rv2g-25mg
  • Microsoft.OpenApi.Kiota.Builder (NuGet) Vendor— Affected 1.25.1 to before 1.35.0 Fixed in 1.35.0 Patch available GHSA-6gw6-rv2g-25mg

Remediation

Update the NuGet packages Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder to version 1.35.0. The sources list no fixed version for kiota.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA kiota (microsoft) Fixed in 1.35.0
  • Fix · CNA Microsoft.OpenApi.Kiota (microsoft) Fixed in 1.35.0
  • Fix · CNA Microsoft.OpenApi.Kiota.Builder (microsoft) Fixed in 1.35.0
  • Fix · GHSA-6gw6-rv2g-25mg Microsoft.OpenApi.Kiota (NuGet) Fixed in 1.35.0 Advisory →
  • Fix · GHSA-6gw6-rv2g-25mg Microsoft.OpenApi.Kiota.Builder (NuGet) Fixed in 1.35.0 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105795
  2. 2026-10-06 Alias added: GHSA-6gw6-rv2g-25mg
  3. 2026-10-06 Fix available: NuGet/[email protected], NuGet/[email protected] · GHSA-6gw6-rv2g-25mg
  4. 2026-10-06 CVSS score added · GHSA-6gw6-rv2g-25mg
  5. 2026-10-06 Weakness changed · GHSA-6gw6-rv2g-25mg
  6. 2026-10-06 6 new references · GHSA-6gw6-rv2g-25mg
  7. 2026-10-06 CISA SSVC decision points changed

References

Advisory 1

Other 5

  • TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences