CVE-2026-105795

Executive Summary

CVE-2026-105795 is a path traversal vulnerability (CWE-22) in Kiota, Microsoft's OpenAPI-based HTTP client code generator. In versions from 1.25.1 up to (but not including) 1.35.0, Kiota copies the OpenAPI extension property x-ai-capabilities.response_semantics.oauth_card_path from a potentially attacker-controlled OpenAPI description into a generated API plugin manifest without validating that the value is a safe package-relative file reference. A consuming host that later resolves this unvalidated reference can be steered across the intended plugin-package boundary or induced to use an unintended authentication card. The impact is rated Low (CVSS 3.1), requires user interaction, and depends on downstream resolution of the unsafe reference — Kiota itself does not read local files or execute code during manifest generation.

Technical Analysis

Kiota is a tool that ingests OpenAPI descriptions and generates typed HTTP client code as well as API plugin manifests consumed by AI/agent hosts. The vulnerability resides in the manifest-generation path for a specific vendor extension: x-ai-capabilities.response_semantics.oauth_card_path.

The mechanism is a classic path traversal / unsafe reference pass-through:

1. Tainted input source — An OpenAPI description contains the extension field x-ai-capabilities.response_semantics.oauth_card_path. The description may originate from a third party, an untrusted registry, or a compromised repository. Because OpenAPI descriptions are declarative data, they are frequently treated as trusted input by developers.

2. Missing validation — Kiota versions 1.25.1 through 1.34.x copy the value of that field verbatim into the generated API plugin manifest. The generator does not validate that the value is a safe, package-relative file reference. Specifically, per the NVD description, the following classes of value are not rejected:

   • Parent-directory traversal sequences (e.g., references that climb out of the intended package directory)
   • Rooted paths
   • Absolute URIs

3. Unsafe reference lands in downstream artifact — The resulting manifest contains a reference that points outside the intended plugin-package boundary or to an unintended authentication card.

4. Downstream resolution is the trigger — Kiota does not resolve the reference itself. Exploitation requires a host application that consumes the manifest and resolves oauth_card_path. Only at that resolution stage does the host cross the package boundary or use an unintended authentication card.

Key scoping facts (directly from the NVD description):

• This is injection of an unsafe reference into a generated artifact, not direct file read or code execution by Kiota.
• Impact is conditional on downstream resolution of the unsafe reference.
• The affected versions are 1.25.1 until 1.35.0; version 1.35.0 fixes the issue.

Because the NVD entry does not disclose the exact validation routine, the internal function names, or the precise manifest schema field name beyond the extension key, no further code-level specifics can be asserted without fabrication. The vulnerability class is unambiguous: unsafe control of a reference value that is later dereferenced, i.e., path traversal / path reference manipulation (CWE-22).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-22) and the mechanics described in the NVD entry. Only the identifiers present in the NVD description are used.

1. Reconnaissance / target identification An adversary identifies a target organization whose development workflow ingests externally supplied or third-party OpenAPI descriptions with Kiota, and whose generated API plugin manifests are consumed by a host that resolves x-ai-capabilities.response_semantics.oauth_card_path. The adversary locates an OpenAPI description the target will process — for example a description obtained from a public API registry, a partner integration, or a compromised repository.

2. Triggering the flaw class The adversary modifies or plants the OpenAPI description so that the extension x-ai-capabilities.response_semantics.oauth_card_path contains a value crafted as a parent-directory traversal, a rooted path, or an absolute URI, rather than a safe package-relative file reference. When the victim runs Kiota (a vulnerable version between 1.25.1 and 1.34.x) to generate the API plugin manifest, Kiota copies that value into the manifest without validation. Note: the user interaction reflected in the CVSS subscore (UI:R) corresponds to a victim generating the client/manifest from the tainted description.

3. Payload / execution method (vulnerability-class level) No code executes during Kiota manifest generation. The "payload" is the malicious reference value itself propagating into the generated artifact. The adversary's objective at this stage is purely to get an unsafe reference written into the manifest.

4. Post-exploitation impact A downstream host that resolves the reference can be made to:

   • Cross the intended plugin-package boundary (access artifacts outside the plugin's package), and/or
   • Use an unintended authentication card. The integrity impact (CVSS I:L) arises from the host acting on the wrong reference. There is no confidentiality or availability impact per the CVSS vector (C:N/A:N), and Kiota itself neither reads a local file nor executes code during generation.

Impact Assessment

• CVSS 3.1 — 3.1 (Low), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N.
  • AV:N — the OpenAPI description can be supplied remotely.
  • AC:H — exploitation requires a specific downstream consumer that resolves the reference; impact is conditional on that resolution occurring.
  • PR:N — no privileges required to craft the malicious description.
  • UI:R — a victim must generate the manifest from the tainted description.
  • S:U — scope is unchanged.
  • C:N — no confidentiality impact.
  • I:L — limited integrity impact via the host crossing a package boundary or using an unintended auth card.
  • A:N — no availability impact.
• Affected systems: build/CI pipelines and developer workstations running Kiota 1.25.1–1.34.x, and the AI/agent hosts consuming the generated API plugin manifests that resolve oauth_card_path.
• Blast radius: Bounded. Kiota's generation step is not itself exploitable to code execution or file read. The real risk surfaces in downstream hosts that dereference the unsafe reference. Organizations that generate manifests from untrusted OpenAPI descriptions and have resolving consumers are the primary exposure group.
• Exploit maturity: No public PoC, no Nuclei template, no known exploit code, not in CISA KEV.

Detection Guidance

Detection focuses on the presence of traversal/rooted/absolute values in the oauth_card_path extension within OpenAPI descriptions and generated manifests, and on CI/build pipeline invocations of vulnerable Kiota versions.

Sigma Rule

title: Kiota API Plugin Manifest Generation With Unsafe oauth_card_path Reference
id: 7f2c9a14-3b6d-4e21-9c8a-2d5e6b1f0a77
status: experimental
description: Detects Kiota client/manifest generation where the OpenAPI description contains a parent-directory, rooted, or absolute-URI value in x-ai-capabilities.response_semantics.oauth_card_path (CVE-2026-105795).
logsource:
  category: process_creation
  product: linux
detection:
  selection_tool:
    Image|endswith:
      - '/kiota'
      - '/kiota.exe'
    CommandLine|contains: 'generate'
  selection_manifest:
    CommandLine|contains: 'plugin'
  condition: selection_tool
fields:
  - CommandLine
  - Image
  - User
falsepositives:
  - Legitimate plugin generation from trusted OpenAPI descriptions
level: medium
tags:
  - attack.t1195.001
  - cve.2026.105795

YARA Rule

rule CVE_2026_105795_Kiota_oauth_card_path_Traversal
{
    meta:
        description = "Detects OpenAPI descriptions or Kiota plugin manifests containing an unsafe oauth_card_path reference (traversal, rooted, or absolute URI)."
        cve = "CVE-2026-105795"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105795"

    strings:
        $ext = "x-ai-capabilities" ascii wide nocase
        $sem = "response_semantics" ascii wide nocase
        $card = "oauth_card_path" ascii wide nocase
        $traversal = /oauth_card_path["'\s:]+[^"\r\n]*\.\.\//
        $rooted = /oauth_card_path["'\s:]+["']?\//
        $absscheme = /oauth_card_path["'\s:]+["']?[a-z][a-z0-9+.-]*:\/\//

    condition:
        (uint32(0) == 0x7B0A2020 or true) and
        filesize < 5MB and
        $ext and $sem and $card and
        ( $traversal or $rooted or $absscheme )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105795 Kiota OpenAPI oauth_card_path Traversal Reference"; flow:established,to_server,from_server; content:"x-ai-capabilities"; http_any; nocase; content:"response_semantics"; nocase; distance:0; content:"oauth_card_path"; nocase; distance:0; pcre:"/oauth_card_path[\"'\s:]+[^\"\s]*(\.\.\/|\/\/|[a-z][a-z0-9+.-]*:\/\/)/i"; reference:cve,2026-105795; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105795; classtype:attempted-recon; sid:2026105795; rev:1;)

Elastic Detection

process where process.name : ("kiota", "kiota.exe") and
  process.command_line : "*generate*" and
  process.command_line : "*plugin*"

Companion file-content hunt (EQL over file events is limited, so a query is provided):

file where file.name : ("*.yaml", "*.yml", "*.json") and
  file.Ext.extension : "x-ai-capabilities" and
  file.Ext.value : "*oauth_card_path*"

Splunk SPL Query

index=main (source="*kiota*" OR sourcetype="openapi" OR sourcetype="plugin_manifest")
| eval raw=_raw
| where match(raw, "x-ai-capabilities") AND match(raw, "response_semantics") AND match(raw, "oauth_card_path")
| rex field=raw "oauth_card_path\W+(?<oauth_card_path>[^\s\"']+)"
| where match(oauth_card_path, "\.\./") OR match(oauth_card_path, "^/") OR match(oauth_card_path, "^[a-zA-Z][a-zA-Z0-9+.\-]*://")
| stats count min(_time) as first_seen max(_time) as last_seen values(oauth_card_path) as unsafe_paths by host, user
| sort - count

Wazuh OSSEC Rule

<group name="threat_intel,cve_2026_105795,">
  <rule id="2026105795" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.type">kiota_manifest_generation</field>
    <regex type="pcre2">oauth_card_path[\"'\s:]+[^\"\s]*(\.\./|^/|[a-z][a-z0-9+.\-]*://)</regex>
    <description>CVE-2026-105795: Kiota generated plugin manifest with unsafe oauth_card_path reference (possible path traversal / unintended auth card).</description>
    <mitre>
      <id>T1195.001</id>
    </mitre>
    <group>cve_2026_105795,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Treat all externally sourced OpenAPI descriptions as untrusted input.
• Before generation, scan OpenAPI descriptions and any generated API plugin manifests for the extension x-ai-capabilities.response_semantics.oauth_card_path and reject values that contain parent-directory traversal sequences, rooted paths, or absolute URIs.
• Do not generate Kiota API plugin manifests from untrusted or unverified descriptions; restrict manifest generation to trusted, version-pinned sources.
• Review consumers of generated manifests and disable or sandbox automatic resolution of oauth_card_path references until manifests are verified.
• In dependency management, pin or override @microsoft/kiota and related Kiota packages to a version at or above 1.35.0 where supported by the registry tooling.

2) Patch/upgrade steps

• Upgrade Kiota to 1.35.0 or later, which per the NVD description fixes the issue (affected range: 1.25.1 until 1.35.0).
• Regenerate all API plugin manifests previously produced by vulnerable versions, then verify each regenerated manifest contains only safe, package-relative oauth_card_path values.
• Re-run integrity checks on any manifests already deployed to downstream agent/plugin hosts.

3) Long-term hardening

• Add policy/gatekeeper checks in CI that fail the build when the oauth_card_path reference is not a package-relative path.
• Enforce provenance and signing for OpenAPI descriptions ingested by build pipelines (T1195.001 supply-chain controls).
• Track Kiota releases and subscribe to advisories; treat CNA/NVD data for this CVE as the authoritative source given the absence of verified patch metadata in tracked sources at time of writing.

References

• NVD — CVE-2026-105795: https://nvd.nist.gov/vuln/detail/CVE-2026-105795
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1195.001 — Compromise Software Dependencies and Development Tools: https://attack.mitre.org/techniques/T1195/001/
• Kiota project (Microsoft) source and release information: https://github.com/microsoft/kiota
• OpenAPI Specification (vendor extensions, x- fields): https://spec.openapis.org/oas/latest.html

Threat actor campaign note: No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or CISA KEV listing are associated with CVE-2026-105795 based on the data provided. EPSS is not yet scored by FIRST.org at the time of writing.