Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U H H N 7.1 .0019 8.5 —
AFFECTED Product Versions Fixed kedro-org/kedro unspecified – —
TIMELINE Mar 9 Reserved by @huntr_ai Jun 12 EXPLOIT PUBLISHED — CVE-2026-3840 (kedro-org/kedro). Public exploit reference added. Jun 12 Published (CNA: @huntr_ai)
A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method in `kedro/io/core.py` directly interpolates user-supplied version strings into filesystem paths without sanitization. This enables an attacker to escape the intended versioned dataset directory and access files outside the expected path. The issue is also reachable through the CLI via the `--load-versions` parameter, as `_split_load_versions()` in `kedro/framework/cli/utils.py` does not validate the version string. This vulnerability can lead to unauthorized file reads, data poisoning, cross-project or cross-tenant data access, and broader downstream impacts in environments where Kedro is used with automation or orchestration layers.
| Date | Event | Detail |
|---|---|---|
| March 9, 2026 | Reserved | Reserved by @huntr_ai |
| June 12, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-3840 (kedro-org/kedro). Public exploit reference added. |
| June 12, 2026 | Published | Published (CNA: @huntr_ai) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| kedro-org | kedro-org/kedro | — | unspecified | — |
Authoritative record: CVE-2026-3840 at cve.org
Vendors: kedro-org
Weaknesses: CWE-22
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-3840 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.