CVE-2026-92791 Details
Description
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process.
A path traversal vulnerability has been identified in Uber Kraken versions through 0.1.29. The issue arises in the build-index component's tag resolution API, which fails to properly validate the tag parameter. This oversight allows unauthenticated attackers to traverse outside the designated storage root by exploiting percent-encoded parent-directory segments in the tag parameter. As a result, attackers can access arbitrary files that the testfs backend process can read.
Users are advised to update to Uber Kraken version 0.1.30 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uber/kraken/issues/645 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/uber/kraken | [email protected] | Vendor |
| https://github.com/uber/kraken/blob/v0.1.27/build-index/tagserver/server.go#L128-L129 | [email protected] | Source CodeVendor |
| https://github.com/uber/kraken/blob/v0.1.27/lib/backend/namepath/pather.go#L78-L84 | [email protected] | Source CodeVendor |
| https://github.com/uber/kraken/blob/v0.1.27/lib/backend/testfs/server.go#L165-L173 | [email protected] | Source CodeVendor |
| https://github.com/uber/kraken/issues/645 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/uber-kraken-through-0.1.29-path-traversal-via-tag-parameter | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Uber Kraken | <= 0.1.29 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |