CVE-2026-35167 Kedro CVE debrief

Who should care

Data science teams using Kedro should assess their exposure and prioritize upgrading to version 1.3.0 or later to prevent unauthorized file reads and data poisoning. Teams should review user-supplied version strings and verify them to prevent exploitation. This involves checking for suspicious activity in shared environments and ensuring that compensating controls are in place for exposed systems.

Why it matters

CVE-2026-35167 is a vulnerability in Kedro that allows unauthorized file reads and data poisoning. Data science teams should prioritize upgrading to version 1.3.0 or later and review user-supplied version strings to prevent exploitation.

• Unauthorized file reads may occur if an attacker can influence the version string.
• Data poisoning is possible if an attacker can write to files outside the intended version directory.
• Cross-tenant data access may be possible in shared environments if an attacker can escape the versioned dataset directory.
• Verification of user-supplied version strings is necessary to prevent exploitation.

Technical summary

The _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization, allowing traversal sequences such as ../ to escape the intended versioned dataset directory. This vulnerability enables unauthorized file reads, data poisoning, or cross-tenant data access in shared environments through multiple entry points, including catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets.

Defensive priority

Data science teams should prioritize upgrading to Kedro version 1.3.0 or later to prevent unauthorized file reads and data poisoning.

Recommended defensive actions

• Upgrade to Kedro version 1.3.0 or later
• Review and sanitize user-supplied version strings
• Monitor for suspicious activity in shared environments
• Verify user-supplied version strings to prevent exploitation
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is caused by the lack of sanitization of user-supplied version strings in the _get_versioned_path() method. This allows attackers to escape the intended versioned dataset directory and access files outside of it.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.