CVE-2026-59864: Microsoft Kiota path traversal in plugin manifest generation

CVE-2026-59864 · Severity: critical · CVSS 4 · Published 2026-07-16

Microsoft Kiota is a code generator used to create AI plugins for Microsoft 365 Copilot and Teams. The tool fails to validate file paths embedded in OpenAPI specifications, allowing attackers to inject path traversal sequences (such as `../`) into generated plugin manifests. When a malicious or compromised OpenAPI description is processed, Kiota writes unsanitized paths directly into the manifest file that the AI host later resolves, potentially exposing files outside the plugin package or loading unauthorized content.

Technologies: Microsoft Kiota, Microsoft Kiota.Builder, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder, Microsoft.OpenApi.Kiota (NuGet), Microsoft.OpenApi.Kiota.Builder (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-59864 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59864 being exploited in the wild.
How severe is CVE-2026-59864?
Critical severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?
Microsoft Kiota < 1.29.1, >= 1.30.0 and < 1.32.5, < 1.32.5; Microsoft Kiota.Builder < 1.29.1, >= 1.30.0 and < 1.32.5; Microsoft.OpenApi.Kiota < 1.32.5; Microsoft.OpenApi.Kiota.Builder < 1.32.5; and 2 more.
Is there a fix for CVE-2026-59864?
Yes. Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.5 or later; Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59864 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59864?
Check whether you run Microsoft Kiota, Microsoft Kiota.Builder, Microsoft.OpenApi.Kiota or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.5 or later
    dotnet add package Microsoft.OpenApi.Kiota --version 1.32.5
  • Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.5 or later
    dotnet add package Microsoft.OpenApi.Kiota.Builder --version 1.32.5

Technical details

The vulnerability is a path traversal (CWE-22) / out-of-package file inclusion (CWE-829) in Kiota's `PluginsGenerationService`. When processing OpenAPI `x-ai-adaptive-card` and `x-ai-capabilities` extensions, Kiota writes the `static_template.file` field verbatim into the generated Copilot/Teams plugin manifest without sanitization. An attacker can craft a malicious OpenAPI specification with traversal sequences like `../../../../../../etc/passwd` or absolute paths; these are copied unchanged into the manifest's `response_semantics.static_template.file`. The vulnerability is not exploitable at build time on the developer's machine, but rather manifests downstream when the generated plugin is deployed to an AI host (Microsoft 365 Copilot or Teams), which resolves the file path relative to the plugin package, allowing out-of-package file references. The attack requires that an attacker control or compromise the OpenAPI description used as input to Kiota. Patches are available in versions 1.29.1 and 1.32.5, which validate file paths to reject absolute URIs, rooted/UNC paths, Windows drive paths, and `..` traversal segments.

Affected products

  • Microsoft OpenAPI Kiota < 1.29.1, >= 1.30.0 and < 1.32.5
  • Microsoft OpenAPI Kiota Builder < 1.29.1, >= 1.30.0 and < 1.32.5

Identifiers

  • CVE-2026-59864
  • GHSA-4jwf-m4wg-8p66

Timeline

  • 2026-07-24: disclosed: GitHub Advisory GHSA-4jwf-m4wg-8p66 published
  • 2026-07-24: patched: Patches released: versions 1.29.1 and 1.32.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.