CVE-2026-92791

Name of the Vulnerable Software and Affected Versions Uber Kraken versions 0.1.0 through 0.1.29

Description An issue exists where the application fails to validate the tag parameter in the '/tags/{tag}' endpoint. This allows unauthenticated attackers to perform directory traversal by using percent-encoded parent-directory segments in the tag parameter, enabling the reading of arbitrary files accessible to the testfs backend process.

Recommendations Update Uber Kraken to a version later than 0.1.29. As a temporary mitigation, restrict access to the '/tags/{tag}' endpoint or avoid using the tag parameter until the update is applied.