Microsoft Kiota CVE-2026-105795: Path Traversal via Unsafe oauth_card_path References

Vulnerability Overview Vulnerability Name: Unsafe oauth_card_path references in Kiota-generated API plugin manifests Description: When generating API plugin manifests from attacker-controlled or compromised OpenAPI descriptions, Kiota copies the field without verifying that it is a secure relative path reference. An attacker can include parent directory traversals, root paths, or absolute URIs instead of files within the plugin package. Impact: Unsafe references propagate into the generated manifests, with their security implications depending on how downstream hosts handle the references. This may lead to non-local code execution or file reading, depending on the behavior of downstream hosts during plugin packaging and deployment. Affected Versions Affected Versions: - (NuGet): >= 1.25.1, = 1.25.1, < 1.35.0 Fixed Versions: 1.35.0 Remediation Patch: Upgrade to Kiota version 1.35.0 or later and regenerate the affected plugin manifests. Kiota now applies the existing secure relative path reference validator to , discarding unsafe references and emitting a warning. Valid relative path references remain supported. Workaround: Generate plugins only from trusted, integrity-protected OpenAPI descriptions. Review generated manifests before packaging or deployment and remove any values that are not secure relative path references. Do not rely on sibling manifest validation within the manifest fields. Related Advisories Related Advisories: GHSA-69wf-m4wa-9p6d and GHSA-p7rm-jp5c-8c77 cover . Their fixes do not enforce separate emission sites for . Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: None - Integrity: Low - Availability: None CVE ID: CVE-2026-105795 Weakness: CWE-22 Credits: - Fix Developer: gavinbarron - Fix Reviewer: adrian05-ms

Goal Reached Thanks to every supporter — we hit 100%!

Microsoft Kiota CVE-2026-105795: Path Traversal via Unsafe oauth_card_path References

More from this source