CVE-2026-35167: Kedro Path Traversal Vulnerability

CVE-2026-35167 Overview

CVE-2026-35167 is a path traversal vulnerability in Kedro, a popular toolbox for production-ready data science. The vulnerability exists in the _get_versioned_path() method within kedro/io/core.py, which constructs filesystem paths by directly interpolating user-supplied version strings without proper sanitization. This allows attackers to use directory traversal sequences such as ../ to escape the intended versioned dataset directory and access arbitrary files on the system.

Critical Impact

An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments.

Affected Products

• Kedro versions prior to 1.3.0
• Data science pipelines using Kedro's versioned dataset functionality
• Multi-tenant environments sharing Kedro infrastructure

Discovery Timeline

• April 6, 2026 - CVE-2026-35167 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35167

Vulnerability Analysis

The vulnerability stems from improper input validation in Kedro's dataset versioning functionality. The _get_versioned_path() method in kedro/io/core.py accepts version strings from multiple user-controllable entry points and directly uses them to construct filesystem paths without sanitizing path traversal sequences. This design flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal.

The attack surface is accessible through multiple entry points within Kedro's API:

1. catalog.load(..., version=...) - Direct API access
2. DataCatalog.from_config(..., load_versions=...) - Configuration-based access
3. CLI via kedro run --load-versions=dataset:../../../secrets - Command-line access

In shared or multi-tenant data science environments, this vulnerability poses significant risks as attackers could access datasets belonging to other users or read sensitive configuration files.

Root Cause

The root cause is the absence of input sanitization for user-supplied version strings before they are used as path components. When a user provides a version string containing directory traversal sequences (e.g., ../), these sequences are preserved during path construction, allowing the resulting path to escape the intended versioned dataset directory and reference arbitrary filesystem locations.

Attack Vector

This vulnerability is exploitable over the network by any authenticated user who can influence the version parameter in Kedro operations. The attack requires low privileges and no user interaction. An attacker can exploit this by supplying a malicious version string containing path traversal sequences through any of the exposed entry points.

For example, an attacker could use the CLI with kedro run --load-versions=dataset:../../../etc/passwd to attempt to read sensitive system files, or in multi-tenant environments, use sequences like ../../../other_tenant/secrets to access another tenant's data.

The vulnerability enables unauthorized file reads from the filesystem, potential data poisoning if attackers can influence what data is loaded into pipelines, and cross-tenant data access in shared hosting environments. For technical details and the specific fix, see the GitHub Security Advisory.

Detection Methods for CVE-2026-35167

Indicators of Compromise

• Unusual version strings in Kedro logs containing ../ or similar path traversal patterns
• Access attempts to files outside normal versioned dataset directories
• Kedro operations loading datasets from unexpected filesystem locations
• Audit logs showing --load-versions CLI parameters with suspicious path components

Detection Strategies

• Monitor Kedro application logs for version parameters containing path traversal sequences such as ../, ..%2f, or encoded variants
• Implement file integrity monitoring on directories outside Kedro's data catalog paths to detect unauthorized access
• Review API call logs and CLI command histories for suspicious load_versions parameter values
• Deploy runtime application self-protection (RASP) solutions to detect and block path traversal attempts

Monitoring Recommendations

• Enable verbose logging in Kedro to capture all version string inputs for audit purposes
• Configure SIEM alerts for log patterns indicating path traversal attempts in Kedro-related processes
• Implement network-level monitoring for data exfiltration patterns following potential unauthorized file reads
• Establish baseline behavioral profiles for normal Kedro operations to identify anomalous dataset loading patterns

How to Mitigate CVE-2026-35167

Immediate Actions Required

• Upgrade Kedro to version 1.3.0 or later immediately, as this version contains the security fix
• Audit existing Kedro deployments for any signs of exploitation by reviewing logs for suspicious version strings
• In multi-tenant environments, verify data isolation and check for unauthorized cross-tenant data access
• Restrict network access to Kedro APIs and CLI interfaces to trusted users only until patching is complete

Patch Information

The vulnerability is fixed in Kedro version 1.3.0. The fix implements proper sanitization of version strings to prevent path traversal sequences from escaping the intended versioned dataset directory. Organizations should upgrade to this version immediately.

For detailed patch information, refer to the GitHub Pull Request #5442 which contains the security fix.

Workarounds

• If immediate upgrading is not possible, implement input validation at the application layer to reject version strings containing ../ or other path traversal sequences
• Deploy a reverse proxy or web application firewall (WAF) to filter malicious version parameters before they reach Kedro
• Restrict filesystem permissions to limit the impact of potential unauthorized file reads
• Run Kedro in a containerized environment with minimal filesystem access to reduce the attack surface

# Upgrade Kedro to the patched version
pip install --upgrade kedro>=1.3.0

# Verify installed version
pip show kedro | grep Version