« Volver al listado

CVE-2026-105795

Estado: Pendiente de análisisBaja (3.1)—

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe package-relative file reference. Parent-directory traversal, rooted paths, or absolute URIs can therefore reach a consuming host that resolves the reference, allowing the host to cross the intended plugin-package boundary or use an unintended authentication card. Kiota does not itself read a local file or execute code merely while generating the manifest, and impact requires downstream resolution of the unsafe reference. This issue is fixed in version 1.35.0.

CVSS

Probabilidad de explotación (EPSS)

FIRST aún no ha puntuado esta CVE (habitual en CVEs muy recientes o rechazadas).

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI:R y requiere interacción (abrir descripción OpenAPI comprometida) → T1203. Path traversal en manifiesto genera acceso a archivos no autorizados (T1005) y potencial manipulación de credenciales OAuth (T1578).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementAuditApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareData Loss Prevention

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Microsoft — KiotaAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-105795",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-105795",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-06T17:17:41.953926Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.1,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "microsoft",
          "product": "kiota",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.25.1, < 1.35.0"
            }
          ]
        },
        {
          "vendor": "microsoft",
          "product": "Microsoft.OpenApi.Kiota",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.25.1, < 1.35.0"
            }
          ]
        },
        {
          "vendor": "microsoft",
          "product": "Microsoft.OpenApi.Kiota.Builder",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.25.1, < 1.35.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-06T15:17:16.437",
  "references": [
    {
      "url": "https://github.com/microsoft/kiota/commit/fc0f219b8a665c4c69be8befcff035ba0eb8e4ce",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/microsoft/kiota/pull/8055",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/microsoft/kiota/releases/tag/v1.35.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-6gw6-rv2g-25mg",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe package-relative file reference. Parent-directory traversal, rooted paths, or absolute URIs can therefore reach a consuming host that resolves the reference, allowing the host to cross the intended plugin-package boundary or use an unintended authentication card. Kiota does not itself read a local file or execute code merely while generating the manifest, and impact requires downstream resolution of the unsafe reference. This issue is fixed in version 1.35.0."
    }
  ],
  "lastModified": "2026-10-06T18:16:47.203",
  "sourceIdentifier": "security-advisories@github.com"
}