Skip to content
fr Sign in
6.1 Medium

CVE-2026-73851 Kiota is an OpenAPI based HTTP Client code generator

Description

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.

Affected products and versions

Product Affected versions Fixed in
kiota 1.30 1.30.0 → < 1.34.0 1.34.0
kiota 1.29 earliest → < 1.29.1 1.29.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of kiota

The 13 CVEs of kiota →
CVE-2026-105796 Kiota is an OpenAPI based HTTP Client code generator 8.8 High CVE-2026-105795 Kiota is an OpenAPI based HTTP Client code generator 3.1 Low CVE-2026-59867 Kiota is an OpenAPI based HTTP Client code generator 7.1 High CVE-2026-59866 Kiota is an OpenAPI based HTTP Client code generator 9.3 Critical
Track this CVE