Path Traversal in Uber Kraken

Uber Kraken versions 0.1.29 and earlier are affected by a path traversal vulnerability tracked as CVE-2026-92791. The issue resides in the /tags/{tag} API endpoint, which fails to properly validate the tag parameter before using it in file system operations. An unauthenticated attacker can exploit this flaw by submitting percent-encoded parent-directory sequences, such as %2e%2e%2f, within the tag parameter. This allows the attacker to traverse outside the designated storage root and access sensitive files on the underlying host that are readable by the testfs backend process. This vulnerability poses a significant risk to confidentiality, potentially exposing configuration files, secrets, or system data.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files on the host system, potentially leading to information disclosure, unauthorized access to credentials, or further compromise of the infrastructure supporting the Kraken container registry service.

Recommendation

• Upgrade Uber Kraken to a version beyond 0.1.29 immediately to remediate CVE-2026-92791.
• Audit access logs for the /tags/{tag} endpoint for indicators of path traversal attempts, specifically looking for URL-encoded dot-dot-slash patterns.
• Implement web application firewall (WAF) rules to block requests containing percent-encoded parent directory traversal sequences targeting the /tags/ endpoint.