CVE-2026-105796

Executive Summary

CVE-2026-105796 is a code-injection defect (CWE-94) in Kiota, Microsoft's OpenAPI-based HTTP client code generator, affecting versions 0.5.0 through 1.34.x. The Java and PHP documentation-comment sanitizers delete block-comment terminators instead of neutralizing them, and the Java sanitizer additionally strips non-ASCII characters after deletion — either behavior can allow overlapping or normalized characters to reform a comment terminator, pushing attacker-controlled OpenAPI description text outside the generated documentation comment and into code context. A developer or build pipeline that generates, compiles, and loads the Java output (or loads the PHP output) executes the injected code in the consuming application or build environment, yielding high confidentiality and integrity impact (CVSS 8.8).

Technical Analysis

Kiota generates HTTP client source code from OpenAPI descriptions, including documentation comments derived from attacker-influenceable fields such as operation descriptions. The vulnerability is a sanitization failure in the documentation-comment emitters for the Java and PHP generators.

The core mechanism is described precisely in the NVD entry: the sanitizers "delete block-comment terminators rather than neutralizing them." A block-comment terminator is a fixed character sequence that closes a comment region. Rather than encoding or escaping the terminator so it cannot terminate the comment, the sanitizer removes it. Removing a substring is not a safe neutralization because the surrounding characters can overlap and reform the very sequence that was deleted. When such an overlapping sequence reconstitutes a terminator in the emitted comment, the comment closes prematurely and subsequent developer-supplied text from the OpenAPI description is emitted as live source code rather than as comment content.

The Java sanitizer compounds the problem: it "also removes non-ASCII characters after deleting terminators, which can create a new terminator during normalization." A sequence that is not a terminator in its original form can become one after non-ASCII characters are stripped, because deletion of intervening characters brings formerly separated characters together. The order of operations (delete terminators, then strip non-ASCII) means the normalization step can synthesize a new terminator that the earlier deletion pass never saw.

The net result in both languages is the same class of defect: attacker-controlled OpenAPI text escapes the documentation comment and is interpreted as code by the Java compiler or PHP runtime. This is CWE-94 (Improper Control of Generation of Code / Code Injection) and aligns with a software supply chain tactic (T1195.002) because the injection point is the generated, build-time artifact rather than a running service endpoint.

The fixed version is 1.35.0. The version range is anchored to the Java defect; the NVD text explicitly notes the range "does not assert that PHP generation existed in every affected release." Insufficient technical detail is available to describe exact sanitizer function names, the precise terminator tokens per language, or the build pipeline stages beyond what is stated here; no public PoC exists.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class and the NVD description, and does not assert specific function, class, or parameter names.

1. Reconnaissance / target identification. The attacker identifies any project or build pipeline that consumes a third-party OpenAPI description and runs Kiota's Java or PHP generator against it, then compiles and loads the generated code. Targets include organizations that generate clients from externally supplied specifications (partner APIs, vendor specs, community-maintained API definitions).

2. Triggering the flaw. The attacker supplies an OpenAPI description whose documentation fields contain text crafted so that a block-comment terminator is reconstituted. For the Java path, the payload accounts for the two-stage behavior: characters are arranged so that after the terminator-deletion pass and the subsequent non-ASCII stripping, the remaining characters reassemble a terminator — i.e., an overlapping or normalization-induced terminator. For the PHP path, the payload relies on overlapping characters surviving terminator deletion and reforming the terminator. When the generator emits the documentation comment, the reconstituted terminator closes the comment early.

3. Payload / execution. Text following the premature terminator in the OpenAPI description is emitted outside the comment, into generated Java or PHP source. Because the generator trusts the description as documentation, the escaped text can contain attacker-directed code. The code is not executed by the generator itself; it executes when a developer compiles and loads the Java output, or when the PHP output is loaded (per the NVD: "then compile and load the Java output or load the PHP output").

4. Post-exploitation impact. Injected code executes "in the consuming application or build environment context." This yields code execution in the developer workstation or CI/CD build environment, with the potential to read secrets, tamper with build artifacts, and propagate to downstream consumers of the generated client. Integrity and confidentiality impact is high (CVSS C:H/I:H), while availability is not rated (A:H — N/A).

Impact Assessment

CVSS 3.1 base score is 8.8 (High): AV:N (attack vector network — the malicious OpenAPI description can be delivered remotely), AC:L (low complexity), PR:N (no privileges required), UI:R (user interaction required — a developer or pipeline must generate, compile, and load the output), S:U (scope unchanged — impact remains in the consuming application/build environment), C:H/I:H/A:H.

The blast radius centers on software supply chain integrity. Any Java or PHP project generating clients from untrusted or third-party OpenAPI descriptions with Kiota 0.5.0–1.34.x is potentially affected. Impact spans developer endpoints and CI/CD build environments where generated code is compiled and loaded, and extends to downstream software that ships the generated client. Because execution occurs through normal build steps rather than an exposed service, the vulnerability can be exploited without a live attack surface and may persist in build infrastructure. There is no CISA KEV listing, no public exploit code, and no Nuclei template as of this report; no EPSS score has been assigned by FIRST.org.

Detection Guidance

Detection focuses on the code-injection escape in generated artifacts and on build-time indicators, since there is no network attack surface inherent to the flaw. The rules below target keywords that are specific to this class of escape (comment terminators adjacent to suspicious content, non-ASCII normalization artifacts) and should be tuned to the environment.

Sigma Rule

title: Kiota Generated-Code Comment Escape / Injected Source Indicator
id: 8b1c6f2e-4a7d-4c3e-9d21-koi105796
status: experimental
description: Detects files containing a block-comment terminator followed by code-like content in Kiota-generated Java/PHP sources, indicating a possible documentation-comment escape (CVE-2026-105796).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105796
author: valtersit.com
date: 2026-01-01
logsource:
  category: file_event
  product: linux
detection:
  selection_ext:
    TargetFilename|endswith:
      - '.java'
      - '.php'
  selection_escape:
    - '*/'
  filter_comment:
    # lines where the terminator is followed by non-comment, code-like tokens
    - '/*'
  condition: selection_ext and selection_escape
  # NOTE: deploy with content matching downstream (see Splunk/Wazuh queries)
falsepositives:
  - Legitimate multi-line comments and generated headers
level: medium
tags:
  - attack.t1195.002
  - cwe.94

YARA Rule

rule CVE_2026_105796_Kiota_Comment_Escape
{
    meta:
        author = "valtersit.com"
        description = "Detects block-comment terminator breakout patterns in Kiota-generated Java/PHP sources (CVE-2026-105796)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105796"
        date = "2026-01-01"
        severity = "high"

    strings:
        // terminator followed by code-like constructs (top-level after comment close)
        $breakout1 = /\/\*[\s\S]{0,2048}?\*\/\s*(public|private|protected|class|function|;\s*echo|<\?php|\$\w+\s*=)/
        // javadoc-style terminator followed by executable token
        $breakout2 = /\*\/\s*(Runtime|System|exec|eval|system|passthru|shell_exec)\s*\(/
        // stray terminator outside an opening comment block
        $stray = "*/"
        // PHP open tag appearing after a comment terminator
        $phptag = /\*\/[\s\S]{0,256}?<\?php/

    condition:
        uint32(0) != 0x04034b50 and
        (any of ($breakout1, $breakout2, $phptag))
}

Suricata IDS Rule

alert file_data any any -> any any (msg:"CVE-2026-105796 Kiota generated-source comment escape indicator (Java/PHP doc-comment breakout)"; file_data; content:"*/"; content:"Runtime"; distance:0; within:256; classtype:attempted-user; reference:cve,2026-105796; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105796; sid:2026105796; rev:1;)

alert file_data any any -> any any (msg:"CVE-2026-105796 Kiota doc-comment breakout - PHP open tag after comment terminator"; file_data; content:"*/"; content:"<?php"; distance:0; within:256; classtype:attempted-user; reference:cve,2026-105796; sid:2026105797; rev:1;)

Note: file_data inspection requires file extraction/HTTP carving enabled; deployed where generated artifacts traverse the network (e.g., CI artifact uploads).

Elastic Detection

file where file.extension in ("java", "php")
  and file.name != null
  and process.name in ("javac", "java", "php", "mvn", "gradle", "composer", "kiota")

Companion event query targeting injected-code indicators in build logs:

process where process.name in ("javac", "mvn", "gradle", "php")
  and process.command_line != null
  and process.command_line : ("*/ Runtime", "*/ System.exec", "*/ system(", "*/ <?php", "*/ eval(")

Note: tune these content matches to the terminator tokens emitted by your specific language target.

Splunk SPL Query

index=build_or_edr (sourcetype=file_events OR sourcetype=code_build_logs)
| search (file_extension="java" OR file_extension="php")
| regex _raw="\*/\s*(Runtime|System\.exec|System\.getRuntime|eval\s*\(|system\s*\(|passthru|shell_exec|<\?php)"
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as hosts values(file_path) as files by user, file_name
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

For build-log-only telemetry:

index=cicd sourcetype=build_logs
| regex _raw="(Kiota|kiota).*(generat|client)|(javac|mvn|gradle|php).*(\*/)"
| regex _raw="\*/\s*(Runtime|eval|system|<\?php)"
| table _time host user build_id _raw

Wazuh OSSEC Rule

<group name="kiota,cve-2026-105796,">
  <rule id="105796" level="12">
    <decoded_as>json</decoded_as>
    <field name="file_extension">\.(java|php)$</field>
    <match>\*/\s*(Runtime|System\.exec|System\.getRuntime|eval\s*\(|system\s*\(|passthru|shell_exec|<\?php)</match>
    <description>CVE-2026-105796: Possible Kiota generated-source documentation-comment escape (Java/PHP code injection indicator) in $(file_path)</description>
    <mitre>
      <id>T1195.002</id>
    </mitre>
    <group>cwe_94,supply_chain,</group>
  </rule>

  <rule id="105797" level="10">
    <decoded_as>json</decoded_as>
    <field name="process">(javac|mvn|gradle|php)</field>
    <match>kiota</match>
    <match>\*/</match>
    <description>CVE-2026-105796: Build step compiling/loading Kiota-generated code containing a comment terminator breakout indicator</description>
    <mitre>
      <id>T1195.002</id>
    </mitre>
    <group>cwe_94,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 1.35.0; no vendor advisory, commit, or patch reference has been confirmed by tracked sources. Treat the following as interim guidance pending verification against a signed vendor release.

1) Immediate mitigations

• Do not run Kiota 0.5.0–1.34.x Java or PHP generation against untrusted, third-party, or externally supplied OpenAPI descriptions.
• Treat OpenAPI descriptions as untrusted build inputs: review documentation fields for embedded block-comment terminators and non-ASCII characters before generation.
• Isolate generation and compilation/loading into least-privilege, network-restricted build environments so injected code cannot reach secrets or production credentials.
• Restrict secrets access from CI/CD runners that compile or load generated clients; enforce short-lived credentials.
• Where the generated client is a static artifact, scan it (SAST/YARA above) for comment-terminator breakouts before distribution.

2) Patch / upgrade steps

• Upgrade Kiota to version 1.35.0, which the NVD reports as containing the fix.
• Because patch confidence is 0/4, independently verify the 1.35.0 release notes and artifact signatures before relying on it.
• After upgrading, regenerate all Java and PHP clients sourced from third-party OpenAPI descriptions and diff the generated output for unexpected content.

3) Long-term hardening

• Pin code-generator versions and validate inputs through a schema allowlist that rejects or encodes control and comment-terminator characters in documentation fields.
• Add CI checks that fail builds when generated sources contain a comment terminator immediately followed by executable tokens.
• Maintain an SBOM/SBOM-like inventory of generator + spec versions per artifact to trace exposure.
• Monitor for any future vendor advisory, CVE update, or patch reference; re-evaluate patch confidence when evidence appears.

References

• NVD — CVE-2026-105796: https://nvd.nist.gov/vuln/detail/CVE-2026-105796
• Microsoft Kiota repository and release notes (verify 1.35.0 fix): https://github.com/microsoft/kiota
• CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK T1195.002 — Compromise Software Supply Chain: https://attack.mitre.org/techniques/T1195/002/
• CISA Known Exploited Vulnerabilities catalog (check for future listing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence was identified for CVE-2026-105796 as of this report. No CISA KEV listing exists. No EPSS score has been assigned by FIRST.org.