CVE-2026-3840: Path Traversal in kedro-org/kedro

Synopsis

A path traversal vulnerability in Kedro version 1.2.0 allows a local attacker with low-privilege access to escape the intended versioned dataset directory by supplying a crafted version string. The flaw exists in the `_get_versioned_path()` method in `kedro/io/core.py`, which interpolates user-supplied version strings into filesystem paths without sanitization; it is also reachable via the `--load-versions` CLI parameter. Successful exploitation gives the attacker read and write access to files outside the intended directory, enabling unauthorized data access, data poisoning, and cross-tenant data leakage. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no elevated or administrative credentials are needed.

• Victim interactionNot required

  No action from another user or victim is required; the attacker can trigger the vulnerability independently.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, specific memory layout, or other environmental prerequisites.

Blast Radius

• Reads arbitrary files on the local filesystem outside the intended versioned dataset directory, including configuration files, credentials, and other projects' data.
• Writes or overwrites files outside the intended directory, poisoning datasets consumed by downstream pipeline runs or other tenants sharing the same filesystem.
• In multi-tenant or orchestrated environments, enables cross-project or cross-tenant data access by traversing shared storage paths.
• Downstream pipeline stages that consume the tampered data inherit the corrupted state, potentially propagating incorrect results through automated workflows.