CVE-2026-35167 Kedro has a path traversal in versioned dataset loading via unsanitized version string
Attackers can manipulate version strings to read or modify files outside the intended dataset directory in Kedro data science projects.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35167?
CVE-2026-35167 is a high-severity path traversal vulnerability in kedro-org kedro, published on 6 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-35167?
3 open source packages ship an affected version, including kedro. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kedro PyPI | All versions | 1.3.0 |
kedro PyPI | All versions | 1.3.0 |
kedro PyPI | All versions | 1.3.0 |
Products include Linuxfoundation Kedro.
How do I fix CVE-2026-35167?
Upgrade kedro to 1.3.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-35167 being exploited?
There is no known exploitation of CVE-2026-35167 in the wild and no public exploit code.
Other vulnerabilities in kedro-org kedro
Sources
Also known as GHSA-6326-w46w-ppjw, PYSEC-2026-71.