CVE-2026-41134 Microsoft CVE debrief

Who should care

Developers using Kiota to generate HTTP clients, especially those generating clients from untrusted or potentially compromised OpenAPI descriptions, should be aware of this vulnerability and take necessary precautions. Affected product deployments should be reviewed for exposure, and owners should be assigned for follow-up. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams and vulnerability management teams should prioritize upgrading Kiota to 1.29.1, 1.31.1, or later and regenerating/refreshing existing generated clients as a precaution. Asset inventory and source tracking should also be reviewed to ensure that affected systems are properly identified and mitigated. Rollback/change windows should be planned for remediation efforts. Monitoring and detection capabilities should be reviewed to ensure that potential exploitation can be detected. Compensating controls should be implemented for exposed systems while remediation is pending. Vendor patch guidance should be followed for upgrading Kiota. Exposure review should be conducted to identify potential vulnerabilities in existing deployments. Asset inventory should be reviewed to identify affected systems. Source tracking should be implemented to monitor for potential exploitation. Security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should check relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should confirm whether affected product deployments exist in their

Technical summary

Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks. Malicious values from an OpenAPI description can be emitted into generated source without context-appropriate escaping, allowing an attacker to break out of string literals and inject additional code into generated clients.

Defensive priority

Upgrade Kiota to 1.29.1, 1.31.1, or later and regenerate/refresh existing generated clients as a precaution.

Recommended defensive actions

• Upgrade Kiota to 1.29.1, 1.31.1, or later
• Regenerate/refresh existing generated clients as a precaution
• Ensure OpenAPI descriptions used for generation are from trusted sources
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-41134 issue affects Kiota versions prior to 1.29.1 and 1.31.1. Malicious values from an OpenAPI description can be emitted into generated source without context-appropriate escaping, allowing an attacker to break out of string literals and inject additional code into generated clients. Only generating from trusted, integrity-protected API descriptions significantly reduces the risk.

Official resources