CVE-2026-92791 uber CVE debrief

Who should care

Defenders responsible for Uber Kraken deployments should assess exposure and verify configurations to prevent path traversal attacks. This includes reviewing and updating configurations, monitoring for suspicious activity, and planning vendor-supported updates or mitigations where exposure is confirmed. Security teams and vulnerability management teams should also be aware of this vulnerability and its potential impact on their environments.

Why it matters

CVE-2026-92791 is a path traversal vulnerability in Uber Kraken through 0.1.29 that allows unauthenticated attackers to read arbitrary files.

• Verify configurations to prevent path traversal attacks.
• Monitor for suspicious activity related to the /tags/{tag} endpoint.
• Update vulnerable versions of Uber Kraken.

Technical summary

Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process. This vulnerability could lead to unauthorized access to sensitive files and data, potentially resulting in data breaches or other security incidents. Defenders should prioritize verifying the affected versions and configurations of Uber Kraken in their environments.

Defensive priority

Defenders should prioritize verifying the affected versions and configurations of Uber Kraken in their environments.

Recommended defensive actions

• Verify the version of Uber Kraken in use and check if it is vulnerable.
• Review and update configurations to prevent path traversal attacks.
• Monitor for any suspicious activity related to the /tags/{tag} endpoint.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD entry provide details on the path traversal vulnerability in Uber Kraken through 0.1.29. The vulnerability allows unauthenticated attackers to traverse outside the configured storage root by manipulating the tag parameter in the /tags/{tag} endpoint. This could lead to unauthorized access to sensitive files and data. Defenders should verify the affected versions and configurations of Uber Kraken in their environments and review configurations to prevent path traversal attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.