Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.1
CVE-2026-105795: Kiota‑generated API plugins may load unsafe files
CVE-2026-105795 · published 29 days ago
Summary
When Kiota creates API plugins from a description, it can copy a file path supplied by an attacker into the plugin’s manifest without checking it. This lets a malicious server cause the host system to load files outside the intended plugin folder or use a fake authentication card. Upgrade Kiota to version 1.35.0 or later to stop the unsafe copying.
What to do
- Update microsoft.openapi.kiota to version 1.35.0.
- Update microsoft.openapi.kiota.builder to version 1.35.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | microsoft | kiota | >= 1.25.1, < 1.35.0 |
| – | microsoft | microsoft.openapi.kiota | >= 1.25.1, < 1.35.0 |
| – | microsoft | microsoft.openapi.kiota.builder | >= 1.25.1, < 1.35.0 |
| nuget | – | microsoft.openapi.kiota |
>= 1.25.1, < 1.35.0 Fix: upgrade to 1.35.0
|
| nuget | – | microsoft.openapi.kiota.builder |
>= 1.25.1, < 1.35.0 Fix: upgrade to 1.35.0
|
Original advisory text
Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe package-relative file reference. Parent-directory traversal, rooted paths, or absolute URIs can therefore reach a consuming host that resolves the reference, allowing the host to cross the intended plugin-package boundary or use an unintended authentication card. Kiota does not itself read a local file or execute code merely while generating the manifest, and impact requires downstream resolution of the unsafe reference. This issue is fixed in version 1.35.0.
References
- https://github.com/microsoft/kiota Product
- https://github.com/microsoft/kiota/releases/tag/v1.35.0 URL
- https://github.com/microsoft/kiota/security/advisories/GHSA-6gw6-rv2g-25mg Vendor Advisory
- https://github.com/microsoft/kiota/commit/fc0f219b8a665c4c69be8befcff035ba0eb8e4... Patch
- https://github.com/microsoft/kiota/pull/8055 Patch
- https://github.com/advisories/GHSA-6gw6-rv2g-25mg
- https://nvd.nist.gov/vuln/detail/CVE-2026-105795 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1057... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published6 Oct 2026
Updated4 Nov 2026
First seen6 Oct 2026
Sources
CVE-2026-105795 · NVD
CVE-2026-105795 · MITRE
GHSA-6gw6-rv2g-25mg · GHSA
CVE-2026-105795 · OSV
GHSA-6gw6-rv2g-25mg · OSV
Track software like this
Free during beta