CVE-2026-3840 Details
Description
A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method in `kedro/io/core.py` directly interpolates user-supplied version strings into filesystem paths without sanitization. This enables an attacker to escape the intended versioned dataset directory and access files outside the expected path. The issue is also reachable through the CLI via the `--load-versions` parameter, as `_split_load_versions()` in `kedro/framework/cli/utils.py` does not validate the version string. This vulnerability can lead to unauthorized file reads, data poisoning, cross-project or cross-tenant data access, and broader downstream impacts in environments where Kedro is used with automation or orchestration layers.
A path traversal vulnerability has been identified in Kedro version 1.2.0. The issue arises in the `_get_versioned_path()` method within `kedro/io/core.py`, where user-supplied version strings are directly inserted into filesystem paths without proper sanitization. This flaw allows an attacker to escape the designated versioned dataset directory and access files outside the expected path. The vulnerability can also be exploited through the command-line interface (CLI) using the `--load-versions` parameter, as the `_split_load_versions()` function in `kedro/framework/cli/utils.py` fails to validate the version string. Exploiting this vulnerability could result in unauthorized file access, data poisoning, cross-project or cross-tenant data exposure, and wider downstream effects in automated or orchestrated Kedro environments.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://huntr.com/bounties/156dead0-1ad5-487f-b7f5-84e707277f76 | CISA-ADP | ExploitThird Party Advisory |
| https://huntr.com/bounties/156dead0-1ad5-487f-b7f5-84e707277f76 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation kedro | 1.2.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |