Executive brief
Uber Kraken is a peer-to-peer Docker registry used to distribute container images. The vulnerability allows unauthenticated attackers to read arbitrary files from the server by manipulating the tag parameter in API requests, potentially exposing sensitive data or credentials stored on the filesystem.
Technical details
Kraken through version 0.1.29 fails to properly validate the tag parameter in the /tags/{tag} endpoint, enabling a path traversal vulnerability. Attackers can use percent-encoded parent-directory sequences (e.g., ../) to escape the configured storage root and access files outside the intended directory. No authentication is required; the vulnerability is network-accessible. An unauthenticated attacker can read any file that the testfs backend process has permission to access, potentially exposing configuration files, credentials, or sensitive application data. A patch should be available in versions after 0.1.29.
Affected products
- Uber Kraken through 0.1.29
Timeline
- 2026-09-16: disclosed