CVE-2026-3840: Kedro Path Traversal Vulnerability – High Severity Data Access Risk

Technical summary

The vulnerability resides in the `_get_versioned_path()` method within `kedro/io/core.py`, which concatenates user-supplied version strings directly into filesystem paths without sanitization. An attacker can leverage path traversal sequences (such as `../`) within the version parameter to escape the versioned dataset directory. The same issue is exposed via CLI through the `--load-versions` parameter, which is processed by `_split_load_versions()` in `kedro/framework/cli/utils.py` without validation. This combination of insufficient input validation and unsafe path construction creates a CWE-22 path traversal condition accessible to local users with execution privileges.

Business impact

In production Kedro deployments, this vulnerability can enable data exfiltration across project or tenant boundaries, compromising confidentiality. An insider or compromised service account could poison datasets belonging to other projects or read proprietary data, particularly damaging in multi-tenant environments or shared automation platforms. Where Kedro pipelines feed into downstream systems (BI tools, ML models, data warehouses), corrupted or unauthorized data access could degrade decision-making quality or introduce compliance violations. Severity is moderated by the requirement for local execution context and existing privileges.

Affected systems

Kedro version 1.2.0 is confirmed vulnerable. Organizations running this version in data engineering or MLOps environments should inventory deployments, especially those integrated with orchestration layers (Airflow, Kubernetes, etc.) or serving multi-tenant use cases. If your Kedro installation is accessed only by fully trusted operators in isolated environments with strict access controls, immediate risk is lower; in shared or automation-heavy contexts, this is a priority.

Exploitability

Exploitation requires local code execution and some level of user privilege (indicated by the PR:L component), making this less trivially exploitable than a remote vector. However, the lack of complexity requirements and the availability of two attack surfaces—programmatic API and CLI—mean that once an attacker gains a foothold, the barrier to abuse is low. Automated pipelines, CI/CD integration, or container orchestration may inadvertently lower this barrier if Kedro runs with elevated privileges or broad filesystem access.

Remediation

Upgrade Kedro beyond version 1.2.0 to a patched release that implements input validation and path sanitization in both `_get_versioned_path()` and `_split_load_versions()`. Verify against the vendor advisory for the specific version that addresses this issue. In the interim, restrict execution of Kedro pipelines to principle-of-least-privilege service accounts, disable or audit use of the `--load-versions` CLI parameter, and enforce filesystem-level access controls to limit which directories Kedro processes can read or write.

Patch guidance

Check the Linux Foundation Kedro project repository and release notes for versions published after June 2026 that address CVE-2026-3840. Apply the patched version to all development, staging, and production Kedro installations. Test the upgrade in a non-production environment to ensure pipeline compatibility, as input validation logic may affect existing workflows that rely on unquoted or special-character-laden version strings. Document any necessary adjustments to automated deployment configurations.

Detection guidance

Monitor Kedro execution for suspicious `--load-versions` parameters containing `../`, `..\`, or absolute paths. Audit filesystem access logs for Kedro processes attempting to read or write files outside their intended dataset directories. Review Kedro logs and application traces for path construction anomalies. In containerized deployments, enforce seccomp or AppArmor profiles to restrict file access scope. Implement network-based monitoring for data exfiltration or unusual data access patterns if Kedro connects to remote storage backends.

Why prioritize this

This vulnerability scores 7.1 (HIGH) due to the combination of high confidentiality and integrity impact in a local privilege context. While not remotely exploitable and not yet in the KEV catalog, the risk is significant for organizations where Kedro handles sensitive data in automated or multi-user environments. It should be prioritized ahead of lower-scoring issues, especially if your infrastructure relies on Kedro for data pipeline orchestration in regulated or competitive sectors.

Risk score, explained

CVSS 3.0 score of 7.1 reflects high impact (C:H, I:H) against confidentiality and integrity, offset by local attack vector (AV:L) and low privilege requirement (PR:L). The attack is not complex (AC:L) and does not require user interaction (UI:N), making it practical to exploit once a foothold is established. The scope is unchanged (S:U), limiting blast radius to the affected system's data. The score does not account for business context, automation amplification, or multi-tenant scenarios where risk may be perceived as higher.

Frequently asked questions