CVE-2026-35171

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35171", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-01T17:26:21.133Z", "datePublished": "2026-04-06T17:45:45.664Z", "dateUpdated": "2026-04-07T15:10:37.613Z"}, "containers": {"cna": {"title": "Arbitrary Code Execution via Malicious Logging Configuration in Kedro", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r"}], "affected": [{"vendor": "kedro-org", "product": "kedro", "versions": [{"version": "< 1.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T17:45:45.664Z"}, "descriptions": [{"lang": "en", "value": "Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0."}], "source": {"advisory": "GHSA-9cqf-439c-j96r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T15:07:48.767240Z", "id": "CVE-2026-35171", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T15:10:37.613Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35171", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T15:07:48.767240Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T15:07:55.111Z"}}], "cna": {"title": "Arbitrary Code Execution via Malicious Logging Configuration in Kedro", "source": {"advisory": "GHSA-9cqf-439c-j96r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "kedro-org", "product": "kedro", "versions": [{"status": "affected", "version": "< 1.3.0"}]}], "references": [{"url": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r", "name": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T17:45:45.664Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35171", "state": "PUBLISHED", "dateUpdated": "2026-04-07T15:10:37.613Z", "dateReserved": "2026-04-01T17:26:21.133Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T17:45:45.664Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kedro", "vendor": "kedro-org", "versions": [{"status": "affected", "version": "< 1.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:kedro:*:*:*:*:*:python:*:*", "matchCriteriaId": "24F97BC8-D0B5-4D19-A22A-81F2A4FDED0E", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0."}, {"lang": "es", "value": "Kedro es una caja de herramientas para ciencia de datos lista para producci\u00f3n. Antes de la versi\u00f3n 1.3.0, Kedro permite que la ruta del archivo de configuraci\u00f3n de registro se establezca a trav\u00e9s de la variable de entorno KEDRO_LOGGING_CONFIG y la carga sin validaci\u00f3n. El esquema de configuraci\u00f3n de registro admite la clave especial (), que permite la instanciaci\u00f3n arbitraria de elementos invocables. Un atacante puede explotar esto para ejecutar comandos de sistema arbitrarios durante el inicio de la aplicaci\u00f3n. Esta es una vulnerabilidad cr\u00edtica de ejecuci\u00f3n remota de c\u00f3digo (RCE) causada por el uso inseguro de logging.config.dictConfig() con entrada controlada por el usuario. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.3.0."}], "id": "CVE-2026-35171", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35171", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T15:07:48.767240Z", "version": "2.0.3"}}]}, "published": "2026-04-06T18:16:43.373", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "kedro", "source": "cna", "vendor": "kedro-org"}, "product": "kedro", "vendor": "kedro-org"}], "analysis": {"en": {"generated_at": "2026-04-14T16:33:11.063541+00:00", "value": {"mitigation_remediation": ["Upgrade Kedro to version 1.3.0 or later."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Kedro project provided by the Linux Foundation (kedro-org:kedro). All releases prior to version 1.3.0 are impacted, as the unsafe handling of user\u2011controlled logging configuration exists only in those older builds.", "description_and_impact": "Kedro, a production\u2011ready data science toolkit, previously allowed a logging configuration file path to be set through the KEDRO_LOGGING_CONFIG environment variable. The logging configuration schema accepts a special () key that can instantiate arbitrary callables, enabling an attacker to execute system commands when the application starts. This flaw permits attackers to inject malicious code and run arbitrary commands with the same privileges as the Kedro process, compromising confidentiality, integrity, and availability of the system.", "risk_and_exploitability": "The CVSS score of 9.8 signals a critical severity, while an EPSS score below 1% indicates that exploit attempts are currently rare or not well known. The feature is not listed in the CISA KEV catalog. Exploitation requires an attacker to influence the KEDRO_LOGGING_CONFIG environment variable or supply a malicious logging configuration file that the Kedro process loads during startup. Once the environment variable is set to a file containing a dangerous callable, the attacker can run arbitrary code in the context of the Kedro application."}}}}, "created": "2026-04-07T06:54:52.444734+00:00", "updated": "2026-04-14T16:41:14.163207+00:00", "vendors": ["kedro-org", "kedro-org$PRODUCT$kedro"]}