# CVE-2026-73851: Microsoft Kiota path traversal in plugin manifest via percent-encoding bypass

Source: https://junglewise.ai/threats/cve-2026-73851-microsoft-kiota-path-traversal-in-plugin-manifest-via-percent  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73851 · Severity: medium · CVSS 4 · Published 2026-08-17

Kiota is a Microsoft tool that generates AI plugin manifests from API specifications. An attacker can inject specially crafted file paths—encoded using URL encoding tricks—into an API specification that the tool processes. If the generated plugin is deployed to an AI system, these malicious paths could allow an attacker to access sensitive files on the host system (such as configuration files or credentials) that should be restricted to the plugin package only. The vulnerability exists because the tool's security checks were bypassed by percent-encoded characters.

Technologies: [Microsoft Kiota](https://junglewise.ai/threats/technologies/kiota), [Microsoft.OpenApi.Kiota (NuGet)](https://junglewise.ai/threats/technologies/nuget-microsoft-openapi-kiota). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-73851 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73851 being exploited in the wild.

**How severe is CVE-2026-73851?** Medium severity, with a CVSS score of 4, published 17 August 2026.

**Which products and versions are affected?** Microsoft Kiota >=1.30.0, <1.34.0 and <1.29.1; Microsoft.OpenApi.Kiota (NuGet) ECOSYSTEM:introduced=1.30.0,fixed=1.34.0.

**Is there a fix for CVE-2026-73851?** Yes. Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.34.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73851 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73851?** Check whether you run Microsoft Kiota or Microsoft.OpenApi.Kiota (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.34.0 or later

  ```sh
  dotnet add package Microsoft.OpenApi.Kiota --version 1.34.0
  ```


## Technical details

The vulnerability is a path traversal (CWE-22) and untrusted functionality inclusion (CWE-829) in the plugin manifest generation logic. Kiota copies `x-ai-capabilities` OpenAPI extension fields (particularly `static_template.file` references) into generated manifest `response_semantics` sections. The validation function `ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference` in `src/Kiota.Builder/OpenApiExtensions/OpenApiAiCapabilitiesExtension.cs` inspected the raw reference string and rejected obvious traversal patterns (`..`, absolute paths, drive-qualified paths, absolute URIs). However, attackers could bypass these checks using percent-encoded equivalents (e.g., `%2e%2e/` for `../`, `file%3A%2F%2F` for `file://`) or multi-level encoding. Additional bypasses included NUL-byte truncation (`%00`), exceeding the decode budget, and Unicode full-width homoglyphs. Patches in v1.34.0 fix this by performing bounded multi-pass decoding before validation, failing closed on residual encoding, rejecting control characters, and NFKC-normalizing Unicode. The attack requires controlling or tampering with the OpenAPI description consumed by Kiota; when the manifest is later processed by an AI host, the unvalidated file references allow path traversal relative to the plugin package directory.

## Affected products

- Microsoft Microsoft.OpenApi.Kiota >=1.30.0, <1.34.0 and <1.29.1

## Identifiers

- CVE-2026-73851
- GHSA-p5rm-jg5c-8c77

## Timeline

- 2026-07-08: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-07-08: patched: Fix released in v1.34.0 and v1.29.1

## References

- [https://api.github.com/users/gavinbarron](https://api.github.com/users/gavinbarron)
- [https://github.com/gavinbarron](https://github.com/gavinbarron)
- [https://api.github.com/users/gavinbarron/gists%7B/gist_id%7D](https://api.github.com/users/gavinbarron/gists%7B/gist_id%7D)
- [https://api.github.com/users/gavinbarron/repos](https://api.github.com/users/gavinbarron/repos)
- [https://avatars.githubusercontent.com/u/7122716?v=4](https://avatars.githubusercontent.com/u/7122716?v=4)
- [https://api.github.com/users/gavinbarron/events%7B/privacy%7D](https://api.github.com/users/gavinbarron/events%7B/privacy%7D)

## Related threats

- [Microsoft Kiota documentation-comment injection in Java and PHP](https://junglewise.ai/threats/cve-2026-105796-kiota-is-an-openapi-based-http-client-code-generator-from-0-5-0)
- [Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests](https://junglewise.ai/threats/cve-2026-105795-kiota-is-an-openapi-based-http-client-code-generator-from-1-25-1)
- [Microsoft Kiota SSRF and File Inclusion via OpenAPI external references](https://junglewise.ai/threats/cve-2026-59867-microsoft-kiota-ssrf-and-file-inclusion-via-openapi-external)
- [Microsoft Kiota path traversal and code injection in OpenAPI generation](https://junglewise.ai/threats/cve-2026-59866-microsoft-kiota-path-traversal-and-code-injection-in-openapi)
- [Microsoft Kiota command injection in kiota info via OpenAPI extension](https://junglewise.ai/threats/cve-2026-59865-microsoft-kiota-command-injection-in-kiota-info-via-openapi)