Path Traversal Vulnerability in Kedro Data Management Tool by Trifacta

CVE-2026-3840

What is CVE-2026-3840?

A security flaw in Kedro version 1.2.0 permits attackers to leverage path traversal techniques via a specially crafted version string. The vulnerability exists because the _get_versioned_path() method in kedro/io/core.py directly incorporates unvalidated user-supplied input into filesystem paths. This oversight allows for unauthorized access to files outside the designated dataset directory. Additionally, the issue can be exploited through the command-line interface using the --load-versions parameter, with _split_load_versions() failing to properly validate the version string. This vulnerability raises significant concerns as it may lead to unauthorized file access, data poisoning, and unintended exposure of data across projects or tenants in environments utilizing Kedro within automation or orchestration frameworks.

References