PT-2026-48927 · Kedro Org · Kedro-Org/Kedro

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-3840

Mitre

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The get versioned path() method in kedro/io/core.py directly interpolates user-supplied version strings into filesystem paths without sanitization. This enables an attacker to escape the intended versioned dataset directory and access files outside the expected path. The issue is also reachable through the CLI via the --load-versions parameter, as split load versions() in kedro/framework/cli/utils.py does not validate the version string. This vulnerability can lead to unauthorized file reads, data poisoning, cross-project or cross-tenant data access, and broader downstream impacts in environments where Kedro is used with automation or orchestration layers.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3840

Affected Products

Kedro-Org/Kedro

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-3840 · Security Note
• https://huntr.com/bounties/156dead0-1ad5-487f-b7f5-84e707277f76 · Note