CVE-2026-73851 microsoft CVE debrief

Who should care

Defenders responsible for Kiota deployments, AI hosts, and systems consuming generated manifests should assess exposure and prioritize updates to fixed versions. This includes verifying configurations, restricting OpenAPI descriptions, and monitoring for suspicious activity related to Kiota deployments. Security teams and vulnerability management teams should also review and act on this vulnerability.

Why it matters

CVE-2026-73851 allows potential file inclusion or disclosure in Kiota deployments. Defenders should verify configurations, restrict OpenAPI descriptions, and update to fixed versions.

• Potential inclusion or disclosure of files outside the intended package boundary
• Verification of Kiota configurations and OpenAPI descriptions is necessary
• Updating to fixed versions 1.29.1 or 1.34.0 is required
• Monitoring for suspicious activity related to Kiota deployments is recommended

Technical summary

Kiota, an OpenAPI-based HTTP Client code generator, is vulnerable to file inclusion or disclosure outside the intended package boundary. An attacker controlling or tampering with the OpenAPI description can supply a file reference resolving outside the manifest package. This can lead to inclusion or disclosure of files outside the intended package boundary when the generated manifest is deployed and consumed by an AI host. The vulnerability is fixed in versions 1.29.1 and 1.34.0. Defenders should prioritize verifying Kiota configurations and updating to fixed versions.

Defensive priority

Defenders should prioritize verifying Kiota configurations and updating to fixed versions 1.29.1 or 1.34.0.

Recommended defensive actions

• Verify Kiota configurations and update to fixed versions 1.29.1 or 1.34.0
• Review and restrict OpenAPI descriptions consumed by Kiota
• Monitor for suspicious activity related to Kiota deployments
• Perform vulnerability scanning and asset inventory of Kiota deployments
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and source references indicate a vulnerability in Kiota, allowing for potential file inclusion or disclosure outside the intended package boundary. Evidence is limited to CVE and NVD details. Defenders should verify Kiota configurations, review OpenAPI descriptions, and monitor for suspicious activity related to Kiota deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.