CVE-2026-73851: Microsoft Kiota path traversal in plugin manifest via percent-encoding bypass

CVE-2026-73851 · Severity: medium · CVSS 4 · Published 2026-08-17

Kiota is a Microsoft tool that generates AI plugin manifests from API specifications. An attacker can inject specially crafted file paths—encoded using URL encoding tricks—into an API specification that the tool processes. If the generated plugin is deployed to an AI system, these malicious paths could allow an attacker to access sensitive files on the host system (such as configuration files or credentials) that should be restricted to the plugin package only. The vulnerability exists because the tool's security checks were bypassed by percent-encoded characters.

Technologies: Microsoft Kiota, Microsoft.OpenApi.Kiota (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-73851 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73851 being exploited in the wild.
How severe is CVE-2026-73851?
Medium severity, with a CVSS score of 4, published 17 August 2026.
Which products and versions are affected?
Microsoft Kiota >=1.30.0, <1.34.0 and <1.29.1; Microsoft.OpenApi.Kiota (NuGet) ECOSYSTEM:introduced=1.30.0,fixed=1.34.0.
Is there a fix for CVE-2026-73851?
Yes. Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.34.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73851 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-73851?
Check whether you run Microsoft Kiota or Microsoft.OpenApi.Kiota (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.34.0 or later
    dotnet add package Microsoft.OpenApi.Kiota --version 1.34.0

Technical details

The vulnerability is a path traversal (CWE-22) and untrusted functionality inclusion (CWE-829) in the plugin manifest generation logic. Kiota copies `x-ai-capabilities` OpenAPI extension fields (particularly `static_template.file` references) into generated manifest `response_semantics` sections. The validation function `ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference` in `src/Kiota.Builder/OpenApiExtensions/OpenApiAiCapabilitiesExtension.cs` inspected the raw reference string and rejected obvious traversal patterns (`..`, absolute paths, drive-qualified paths, absolute URIs). However, attackers could bypass these checks using percent-encoded equivalents (e.g., `%2e%2e/` for `../`, `file%3A%2F%2F` for `file://`) or multi-level encoding. Additional bypasses included NUL-byte truncation (`%00`), exceeding the decode budget, and Unicode full-width homoglyphs. Patches in v1.34.0 fix this by performing bounded multi-pass decoding before validation, failing closed on residual encoding, rejecting control characters, and NFKC-normalizing Unicode. The attack requires controlling or tampering with the OpenAPI description consumed by Kiota; when the manifest is later processed by an AI host, the unvalidated file references allow path traversal relative to the plugin package directory.

Affected products

  • Microsoft Microsoft.OpenApi.Kiota >=1.30.0, <1.34.0 and <1.29.1

Identifiers

  • CVE-2026-73851
  • GHSA-p5rm-jg5c-8c77

Timeline

  • 2026-07-08: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-07-08: patched: Fix released in v1.34.0 and v1.29.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.