Vulnerability-Lookup

CVE-2026-35171 (GCVE-0-2026-35171)

Vulnerability from cvelistv5 – Published: 2026-04-06 17:45 – Updated: 2026-04-07 15:10

Title

Arbitrary Code Execution via Malicious Logging Configuration in Kedro

Summary

Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-502 - Deserialization of Untrusted Data

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/kedro-org/kedro/security/advis…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
kedro-org	kedro	Affected: < 1.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35171",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T15:07:48.767240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T15:10:37.613Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kedro",
          "vendor": "kedro-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-06T17:45:45.664Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r"
        }
      ],
      "source": {
        "advisory": "GHSA-9cqf-439c-j96r",
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary Code Execution via Malicious Logging Configuration in Kedro"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-35171",
    "datePublished": "2026-04-06T17:45:45.664Z",
    "dateReserved": "2026-04-01T17:26:21.133Z",
    "dateUpdated": "2026-04-07T15:10:37.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-35171",
      "date": "2026-07-25",
      "epss": "0.00714",
      "percentile": "0.49916"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-35171\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-06T18:16:43.373\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0.\"},{\"lang\":\"es\",\"value\":\"Kedro es una caja de herramientas para ciencia de datos lista para producci\u00f3n. Antes de la versi\u00f3n 1.3.0, Kedro permite que la ruta del archivo de configuraci\u00f3n de registro se establezca a trav\u00e9s de la variable de entorno KEDRO_LOGGING_CONFIG y la carga sin validaci\u00f3n. El esquema de configuraci\u00f3n de registro admite la clave especial (), que permite la instanciaci\u00f3n arbitraria de elementos invocables. Un atacante puede explotar esto para ejecutar comandos de sistema arbitrarios durante el inicio de la aplicaci\u00f3n. Esta es una vulnerabilidad cr\u00edtica de ejecuci\u00f3n remota de c\u00f3digo (RCE) causada por el uso inseguro de logging.config.dictConfig() con entrada controlada por el usuario. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.3.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"kedro-org\",\"product\":\"kedro\",\"versions\":[{\"version\":\"\u003c 1.3.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-07T15:07:48.767240Z\",\"id\":\"CVE-2026-35171\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"},{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:linuxfoundation:kedro:*:*:*:*:*:python:*:*\",\"versionEndExcluding\":\"1.3.0\",\"matchCriteriaId\":\"24F97BC8-D0B5-4D19-A22A-81F2A4FDED0E\"}]}]}],\"references\":[{\"url\":\"https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-04-07T23:01:07+00:00",
      "cve": "CVE-2026-35171",
      "id": "CVE-2026-35171",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Arbitrary Code Execution via Malicious Logging Configuration in Kedro",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35171.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-35171\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-07T15:07:48.767240Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-07T15:07:55.111Z\"}}], \"cna\": {\"title\": \"Arbitrary Code Execution via Malicious Logging Configuration in Kedro\", \"source\": {\"advisory\": \"GHSA-9cqf-439c-j96r\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"kedro-org\", \"product\": \"kedro\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.3.0\"}]}], \"references\": [{\"url\": \"https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r\", \"name\": \"https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502: Deserialization of Untrusted Data\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-06T17:45:45.664Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-35171\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-07T15:10:37.613Z\", \"dateReserved\": \"2026-04-01T17:26:21.133Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-06T17:45:45.664Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-35171

Vulnerability from fkie_nvd - Published: 2026-04-06 18:16 - Updated: 2026-06-17 10:40

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r	Vendor Advisory

Impacted products

	Vendor	Product	Version
	linuxfoundation	kedro	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kedro",
          "vendor": "kedro-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:kedro:*:*:*:*:*:python:*:*",
              "matchCriteriaId": "24F97BC8-D0B5-4D19-A22A-81F2A4FDED0E",
              "versionEndExcluding": "1.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0."
    }
  ],
  "id": "CVE-2026-35171",
  "lastModified": "2026-06-17T10:40:09.007",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-35171",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-07T15:07:48.767240Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-06T18:16:43.373",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-9CQF-439C-J96R

Vulnerability from github – Published: 2026-04-03 03:48 – Updated: 2026-06-06 00:23

Summary

Kedro has Arbitrary Code Execution via Malicious Logging Configuration

Details

Impact

This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input.

Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup.

Patches

The vulnerability is fixed by introducing validation that rejects the unsafe () factory key in logging configurations before passing them to dictConfig().

Fixed in

Kedro 1.3.0

Users should upgrade to this version as soon as possible.

Workarounds

If upgrading is not immediately possible:

Do not allow untrusted input to control the KEDRO_LOGGING_CONFIG environment variable
Restrict write access to logging configuration files
Avoid using externally supplied or dynamically generated logging configs
Manually validate logging YAML to ensure it does not contain the () key

These mitigations reduce risk but do not fully eliminate it.

References

Python logging configuration documentation: https://docs.python.org/3/library/logging.config.html#logging-config-dictschema
CWE-94: Code Injection — https://cwe.mitre.org/data/definitions/94.html

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "kedro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35171"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-03T03:48:48Z",
    "nvd_published_at": "2026-04-06T18:16:43Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nThis is a **critical remote code execution (RCE)** vulnerability caused by unsafe use of `logging.config.dictConfig()` with user-controlled input.\n\nKedro allows the logging configuration file path to be set via the `KEDRO_LOGGING_CONFIG` environment variable and loads it without validation. The logging configuration schema supports the special `()` key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup.\n\n---\n\n### Patches\n\nThe vulnerability is fixed by introducing validation that rejects the unsafe `()` factory key in logging configurations before passing them to `dictConfig()`.\n\n#### Fixed in\n- Kedro 1.3.0\n\nUsers should upgrade to this version as soon as possible.\n\n---\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n- Do not allow untrusted input to control the `KEDRO_LOGGING_CONFIG` environment variable  \n- Restrict write access to logging configuration files  \n- Avoid using externally supplied or dynamically generated logging configs  \n- Manually validate logging YAML to ensure it does not contain the `()` key  \n\nThese mitigations reduce risk but do not fully eliminate it.\n\n---\n\n### References\n\n- Python logging configuration documentation: https://docs.python.org/3/library/logging.config.html#logging-config-dictschema  \n- CWE-94: Code Injection \u2014 https://cwe.mitre.org/data/definitions/94.html",
  "id": "GHSA-9cqf-439c-j96r",
  "modified": "2026-06-06T00:23:45Z",
  "published": "2026-04-03T03:48:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35171"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kedro-org/kedro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/kedro/PYSEC-2026-72.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kedro has Arbitrary Code Execution via Malicious Logging Configuration"
}

PYSEC-2026-72

Vulnerability from pysec - Published: 2026-04-06 18:16 - Updated: 2026-05-20 09:19

Details

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impacted products

Name	purl
kedro	pkg:pypi/kedro

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "kedro",
        "purl": "pkg:pypi/kedro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.14.0",
        "0.14.1",
        "0.14.2",
        "0.14.3",
        "0.15.0",
        "0.15.1",
        "0.15.2",
        "0.15.3",
        "0.15.4",
        "0.15.5",
        "0.15.6",
        "0.15.7",
        "0.15.8",
        "0.15.9",
        "0.16.0",
        "0.16.1",
        "0.16.2",
        "0.16.3",
        "0.16.4",
        "0.16.5",
        "0.16.6",
        "0.17.0",
        "0.17.1",
        "0.17.2",
        "0.17.3",
        "0.17.4",
        "0.17.5",
        "0.17.6",
        "0.17.7",
        "0.18.0",
        "0.18.1",
        "0.18.10",
        "0.18.11",
        "0.18.12",
        "0.18.13",
        "0.18.14",
        "0.18.2",
        "0.18.3",
        "0.18.4",
        "0.18.5",
        "0.18.6",
        "0.18.7",
        "0.18.8",
        "0.18.9",
        "0.19.0",
        "0.19.1",
        "0.19.10",
        "0.19.11",
        "0.19.12",
        "0.19.13",
        "0.19.14",
        "0.19.15",
        "0.19.2",
        "0.19.3",
        "0.19.4",
        "0.19.5",
        "0.19.6",
        "0.19.7",
        "0.19.8",
        "0.19.9",
        "1.0.0",
        "1.0.0rc1",
        "1.0.0rc2",
        "1.0.0rc3",
        "1.1.0",
        "1.1.1",
        "1.2.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35171",
    "GHSA-9cqf-439c-j96r"
  ],
  "details": "Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0.",
  "id": "PYSEC-2026-72",
  "modified": "2026-05-20T09:19:03.377815Z",
  "published": "2026-04-06T18:16:43.373Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-35171 (GCVE-0-2026-35171)

FKIE_CVE-2026-35171

GHSA-9CQF-439C-J96R

Impact

Patches

Fixed in

Workarounds

References

PYSEC-2026-72

Tags

Sightings

Nomenclature