CVE-2026-73851

The CVSS 6.1 assigned to this Kiota path traversal vulnerability measures the wrong thing. It captures technical exploit difficulty within Kiota's own codebase, but completely misses the downstream blast radius across AI-assisted development pipelines where this tool is increasingly embedded. The vulnerability itself is straightforward: Kiota resolves external references during manifest generation without sanitizing traversal sequences or validating URI schemes. The precondition—attacker controls the OpenAPI description—is where the analysis stops for most teams. But in AI-assisted development workflows, that precondition is structurally guaranteed, not exceptional. AI tools generate specs, shared repositories feed pipelines, and organizational boundaries blur around what counts as a "trusted" spec source. The trust boundary that should exist around OpenAPI spec handling simply doesn't exist in practice because the workflow ergonomics actively discourage skepticism—verification breaks the automation promise that makes these pipelines valuable. The multi-step exploitation chain doesn't make this harder to exploit; it makes it easier. An attacker compromising a shared spec repository doesn't need to chain anything sophisticated—they wait for automated pipelines to process the malicious spec and distribute weaponized manifests to every downstream consumer simultaneously. The blast radius isn't the file on the Kiota machine; it's the entire surface exposed by AI hosts now consuming potentially contaminated manifests. The dual-patch timeline (versions 1.29.1 and 1.34.0) is a maintenance debt signal suggesting the vulnerable reference resolution logic exists in multiple diverged code lineages. The fix addresses the symptom, but the architectural problem persists: deep spec resolution is a functional requirement that directly conflicts with reference integrity as a security property. Every future extension to Kiota's reference handling will traverse the same vulnerable terrain. Realistically, your hardening options are: patch immediately (both versions), treat OpenAPI specs as untrusted pipeline inputs regardless of source, and audit your AI host consumption of Kiota manifests for loose parsing that could amplify this further. The orphaned half of this vulnerability chain—the AI hosts consuming unvalidated manifests—likely hasn't been patched and may never be, because it wasn't in the CVE.

Reviewed through automated stages and approved by a human before publication.