Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M

CVE-2026-105795Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Low 3.1

In plain English

A low-severity path traversal in kiota from microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)1.2%top 31.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe package-relative file reference. Parent-directory traversal, rooted paths, or absolute URIs can therefore reach a consuming host that resolves the reference, allowing the host to cross the intended plugin-package boundary or use an unintended authentication card. Kiota does not itself read a local file or execute code merely while generating the manifest, and impact requires downstream resolution of the unsafe reference. This issue is fixed in version 1.35.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
NuGetmicrosoft.openapi.kiota1.35.0GHSA-6gw6-rv2g-25mg
NuGetmicrosoft.openapi.kiota.builder1.35.0GHSA-6gw6-rv2g-25mg

Affected products (as reported)

VendorProductVersions
microsoft kiota >= 1.25.1, < 1.35.0
microsoft Microsoft.OpenApi.Kiota >= 1.25.1, < 1.35.0
microsoft Microsoft.OpenApi.Kiota.Builder >= 1.25.1, < 1.35.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

References