CVE-2026-35167General(linuxfoundation / kedro)

LOWCVSS 8.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for linuxfoundation kedro systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0.

linuxfoundation CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/kedro-org/kedro/security/advisories/GHSA-6326-w46w-ppjw

Other references

https://github.com/kedro-org/kedro/pull/5442

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kedro

Threat summary

Public PoC and exploit tooling are both present
2 mentions across 2 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-04-06); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

linuxfoundation

Products

kedro

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

PoC

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-06	1	General1
2026-05-12	1	PoC1

Full discourse2 posts

Noobosaurus R3x 🦖@NoobosaurusR3x149d
PoC
J’ai écrit un petit article sur ma première CVE 🎉 Dedans il y a du Python, du ../, un peu de confusion CVSS, et moi qui essaie de faire genre je maîtrise le process. J'espère que ça va vous plaire :D https://nooblogaurus.online/articles/cve-2026-35167-kedro-path-traversal/
Post summary
The user shares an article containing Python PoC code that demonstrates a path‑traversal vulnerability (CVE‑2026‑35167) without mentioning active exploitation or patching.
7813472.0K
2.7K followersView on X
CVE@CVEnew185d
General
CVE-2026-35167 Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly int… https://www.cve.org/CVERecord?id=CVE-2026-35167
Post summary
The post is a brief mention of CVE-2026-35167 affecting Kedro’s path construction, providing no further technical detail, exploitation, or remediation information.
0000085
57.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	linuxfoundation	kedro	-	python	-

Explore more

Back to dashboard linuxfoundation CVEs kedro vulnerabilities