CVE-2026-73851 — CVE & Security Advisory Radar

🎯 CVE-2026-73851 MEDIUM 6.1 🔥 EPSS 1.5% 🧪 PoC 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2026-73851 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.

Klassifikation & Betroffenheit:

Microsoft kiota < 1.29.1kiota 1.30.0, < 1.34.0

Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-57985 7.6 CVE-2025-59251 7.6 CVE-2025-29815 7.6 CVE-2024-49053 7.6 CVE-2024-43579 7.6

🩹 Patch verfügbar (OSV):

🩹 9d4f80e2006eeebc2b3a641d92edecdad70be2de (Commit) 🩹 70cd8bcba3ff1815f93187f3eb80ef96fd194d46 (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 08/2026

Heute 03.09.

CVSS-Vektor-Analyse: 6.1

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Veröffentlicht:17.08.2026

Aktualisiert:17.08.2026 16:17

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2026-60233

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Patch-Tuesday Update einspielen oder betroffene Dienste in Windows Defender isolieren.

Tier	2026-08-29	2026-09-02
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

6.1 MEDIUM

🇪🇺 EUVD

EPSS

1.5%

CVE-2026-73851 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

🧪 Microsoft

CVE-2026-73851 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Patch-Tuesday Update einspielen oder betroffene Dienste in Windows Defender isolieren.

17.08.2026

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub