Vulnerability Details CVE-2026-35167
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory.
This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 18.5%
CVSS Severity
CVSS v3 Score 7.1
References
Products affected by CVE-2026-35167
-
cpe:2.3:a:linuxfoundation:kedro:0.14.0
-
cpe:2.3:a:linuxfoundation:kedro:0.14.1
-
cpe:2.3:a:linuxfoundation:kedro:0.14.2
-
cpe:2.3:a:linuxfoundation:kedro:0.14.3
-
cpe:2.3:a:linuxfoundation:kedro:0.15.0
-
cpe:2.3:a:linuxfoundation:kedro:0.15.1
-
cpe:2.3:a:linuxfoundation:kedro:0.15.2
-
cpe:2.3:a:linuxfoundation:kedro:0.15.3
-
cpe:2.3:a:linuxfoundation:kedro:0.15.4
-
cpe:2.3:a:linuxfoundation:kedro:0.15.5
-
cpe:2.3:a:linuxfoundation:kedro:0.15.6
-
cpe:2.3:a:linuxfoundation:kedro:0.15.7
-
cpe:2.3:a:linuxfoundation:kedro:0.15.8
-
cpe:2.3:a:linuxfoundation:kedro:0.15.9
-
cpe:2.3:a:linuxfoundation:kedro:0.16.0
-
cpe:2.3:a:linuxfoundation:kedro:0.16.1
-
cpe:2.3:a:linuxfoundation:kedro:0.16.2
-
cpe:2.3:a:linuxfoundation:kedro:0.16.3
-
cpe:2.3:a:linuxfoundation:kedro:0.16.4
-
cpe:2.3:a:linuxfoundation:kedro:0.16.5
-
cpe:2.3:a:linuxfoundation:kedro:0.16.6
-
cpe:2.3:a:linuxfoundation:kedro:0.17.0
-
cpe:2.3:a:linuxfoundation:kedro:0.17.1
-
cpe:2.3:a:linuxfoundation:kedro:0.17.2
-
cpe:2.3:a:linuxfoundation:kedro:0.17.3
-
cpe:2.3:a:linuxfoundation:kedro:0.17.4
-
cpe:2.3:a:linuxfoundation:kedro:0.17.5
-
cpe:2.3:a:linuxfoundation:kedro:0.17.6
-
cpe:2.3:a:linuxfoundation:kedro:0.17.7
-
cpe:2.3:a:linuxfoundation:kedro:0.18.0
-
cpe:2.3:a:linuxfoundation:kedro:0.18.1
-
cpe:2.3:a:linuxfoundation:kedro:0.18.10
-
cpe:2.3:a:linuxfoundation:kedro:0.18.11
-
cpe:2.3:a:linuxfoundation:kedro:0.18.12
-
cpe:2.3:a:linuxfoundation:kedro:0.18.13
-
cpe:2.3:a:linuxfoundation:kedro:0.18.14
-
cpe:2.3:a:linuxfoundation:kedro:0.18.2
-
cpe:2.3:a:linuxfoundation:kedro:0.18.3
-
cpe:2.3:a:linuxfoundation:kedro:0.18.4
-
cpe:2.3:a:linuxfoundation:kedro:0.18.5
-
cpe:2.3:a:linuxfoundation:kedro:0.18.6
-
cpe:2.3:a:linuxfoundation:kedro:0.18.7
-
cpe:2.3:a:linuxfoundation:kedro:0.18.8
-
cpe:2.3:a:linuxfoundation:kedro:0.18.9
-
cpe:2.3:a:linuxfoundation:kedro:0.19.0
-
cpe:2.3:a:linuxfoundation:kedro:0.19.1
-
cpe:2.3:a:linuxfoundation:kedro:0.19.10
-
cpe:2.3:a:linuxfoundation:kedro:0.19.11
-
cpe:2.3:a:linuxfoundation:kedro:0.19.12
-
cpe:2.3:a:linuxfoundation:kedro:0.19.13
-
cpe:2.3:a:linuxfoundation:kedro:0.19.14
-
cpe:2.3:a:linuxfoundation:kedro:0.19.15
-
cpe:2.3:a:linuxfoundation:kedro:0.19.2
-
cpe:2.3:a:linuxfoundation:kedro:0.19.3
-
cpe:2.3:a:linuxfoundation:kedro:0.19.4
-
cpe:2.3:a:linuxfoundation:kedro:0.19.5
-
cpe:2.3:a:linuxfoundation:kedro:0.19.6
-
cpe:2.3:a:linuxfoundation:kedro:0.19.7
-
cpe:2.3:a:linuxfoundation:kedro:0.19.8
-
cpe:2.3:a:linuxfoundation:kedro:0.19.9
-
cpe:2.3:a:linuxfoundation:kedro:1.0.0
-
cpe:2.3:a:linuxfoundation:kedro:1.1.0
-
cpe:2.3:a:linuxfoundation:kedro:1.1.1
-
cpe:2.3:a:linuxfoundation:kedro:1.2.0