← Back to CVE List
CVE-2026-92791NVD
Vulnerability Summary
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process.
CVSS v4.0 Base Metrics — Score 8.7 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)None
Availability (Vulnerable System)None
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 7.5 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
Affected & Patched Versions
- uber kraken <= 0.1.29
- uber kraken 0.1.29
External References
- https://github.com/uber/kraken/issues/645
- https://github.com/uber/kraken
- https://github.com/uber/kraken/blob/v0.1.27/lib/backend/namepath/pather.go#L78-L84
- https://github.com/uber/kraken/blob/v0.1.27/lib/backend/testfs/server.go#L165-L173
- https://github.com/uber/kraken/blob/v0.1.27/build-index/tagserver/server.go#L128-L129
- https://www.vulncheck.com/advisories/uber-kraken-through-0.1.29-path-traversal-via-tag-parameter