CVE-2026-73851: 
C# vulnerability analysis and mitigation

CVE-2026-73851 is a path traversal vulnerability in Microsoft Kiota, an OpenAPI-based HTTP client code generator, affecting the NuGet package Microsoft.OpenApi.Kiota. An attacker who controls or tampers with an OpenAPI description consumed by Kiota can supply a malicious static_template.file reference (e.g., ../../../../etc/passwd, absolute paths, or file:///http(s):// URIs) that resolves outside the intended manifest package boundary. The vulnerability affects versions prior to 1.29.1 and versions 1.30.0 through 1.33.x (prior to 1.34.0), and was disclosed on August 17, 2026. It carries a CVSS v4.0 base score of 6.1 (Medium) (GitHub Advisory, Feedly).

The root cause is improper input validation in ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference within src/Kiota.Builder/OpenApiExtensions/OpenApiAiCapabilitiesExtension.cs, classified as CWE-22 (Path Traversal) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). A partial mitigation shipped in v1.32.5 introduced IsSafeFileReference to reject literal traversal sequences, rooted paths, and absolute URIs, but it inspected the raw reference string without decoding percent-encoded characters first. This allowed bypasses via: (1) percent-encoded sequences like %2e%2e/card.json (decodes to ../card.json), (2) double-encoded variants like %252e%252e%252fcard.json, (3) embedded NUL bytes (%00) that defeated segment checks, (4) encoding deeper than the 5-pass decode budget (fail-open behavior), and (5) Unicode full-width homoglyphs (e.g., %EF%BC%8E%EF%BC%8E → ．．) not treated as ... The fix in PRs #7910 and #7913 decodes references in a bounded loop before validation, fails closed on residual encoding, rejects control characters, and applies NFKC normalization (GitHub Advisory, PR #7910, PR #7913).

When a maliciously crafted OpenAPI description is processed by Kiota and the resulting plugin manifest is deployed to an AI host, the AI host may resolve the response_semantics.static_template.file reference to files outside the intended package boundary — including sensitive system files such as /etc/passwd or arbitrary files accessible to the AI host process. The primary impact is confidentiality loss (high sub-system confidentiality impact per CVSS v4.0), as sensitive files can be disclosed to the AI host or its consumers. There is no direct integrity or availability impact, but the exposure of sensitive configuration or credential files could enable further lateral movement or privilege escalation (GitHub Advisory, Feedly).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to control or tamper with the OpenAPI description consumed by Kiota (e.g., via a supply chain attack or man-in-the-middle on an untrusted OpenAPI source), and user interaction is required in the sense that a developer must generate and deploy the manifest. No threat actor attribution is available (Feedly, GitHub Advisory).

1. Identify a target: Locate a development pipeline or CI/CD workflow that uses a vulnerable version of Microsoft.OpenApi.Kiota (< 1.29.1 or 1.30.0–1.33.x) to generate AI plugin manifests from an OpenAPI description.
2. Tamper with the OpenAPI description: Gain control of the OpenAPI description file consumed by Kiota — either by compromising the source repository, intercepting an HTTP fetch of a remote OpenAPI spec, or supplying a malicious spec directly. Insert a crafted x-ai-capabilities extension with a static_template field containing a percent-encoded path traversal payload, e.g.:

   x-ai-capabilities:
     response_semantics:
       static_template:
         file: "%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"

3. Trigger manifest generation: Cause Kiota to process the malicious OpenAPI description (e.g., by triggering a CI pipeline or running kiota generate). The IsSafeFileReference validator in vulnerable versions accepts the percent-encoded payload as safe and writes it verbatim into the generated plugin manifest's response_semantics.static_template.file field.
4. Deploy the manifest: The generated manifest (containing the traversal reference) is packaged and deployed to an AI host environment.
5. Achieve file disclosure: When the AI host loads the plugin manifest and resolves the static_template.file reference, it reads the file at the traversed path (e.g., /etc/passwd) outside the intended package boundary, disclosing its contents to the AI host or its consumers (GitHub Advisory, PR #7910).

• File System: Generated plugin manifest files containing a response_semantics.static_template.file value with percent-encoded sequences (e.g., %2e, %2f, %3a), .. segments, absolute paths, or file:///http(s):// URIs — particularly in the adaptiveCards/ folder or adjacent manifest JSON files.
• File System: Unexpected or anomalous static_template.file values in deployed AI plugin manifests that reference paths outside the plugin package directory (e.g., values resolving to /etc/passwd, Windows system paths, or external URIs).
• Logs: Build or CI/CD pipeline logs showing Kiota processing OpenAPI descriptions from untrusted or external sources without integrity verification.
• Network: Unexpected outbound requests from the AI host process to external URIs referenced in static_template.file fields (e.g., http:// or https:// URIs supplied by a malicious OpenAPI description) (GitHub Advisory, Issue #7912).

Upgrade Microsoft.OpenApi.Kiota to version 1.29.1 or 1.34.0 (or later), which include the complete fix for both the percent-encoding bypass (PR #7910) and residual bypasses including NUL bytes, deep encoding, and Unicode homoglyphs (PR #7913). As a workaround for those unable to upgrade immediately, only generate clients and plugins from trusted OpenAPI descriptions obtained from verified sources. Additionally, review all generated plugin manifests before deployment and reject any response_semantics.static_template.file value that is not a simple relative path within the adaptiveCards/ package folder — specifically rejecting any value containing .., rooted/absolute paths, URIs, or percent-encoded separators (GitHub Advisory).