CVE-2026-92791

Overview

Uber Kraken 0.1.29 allows unauthenticated users to read arbitrary files outside the intended storage root via the /tags/{tag} endpoint. The flaw arises from missing validation of the tag parameter, enabling path‑traversal attacks using percent‑encoded directory segments.

Description

Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process.

Impact

{'confidentiality': 'High – attackers can read any file accessible to the testfs backend process, potentially exposing sensitive configuration, credentials, or user data.', 'integrity': 'Low – the vulnerability does not allow modification of files.', 'availability': 'Low – the flaw does not disrupt service operation.'}

Remediation

['Upgrade Uber Kraken to a patched version (≥0.1.30) that validates the tag parameter and normalizes paths.', "If upgrading is not immediately possible, implement a defensive filter that rejects any tag containing '..' or percent‑encoded parent‑directory sequences.", 'Configure the testfs backend to run with the least privilege and enforce a strict chroot or filesystem isolation so that even if traversal occurs, it cannot reach sensitive files.', 'Apply the principle of least privilege to the process that serves the /tags endpoint, ensuring it only has read access to the intended storage directory.']

Risk context

High severity (CVSS v3 7.5, CVSS v4 8.7). The vulnerability permits unauthenticated file disclosure, making it a priority for immediate patching or mitigation.

Affected products

• Uber Kraken 0.1.29