CVE-2026-35171
Kedro, a data science toolbox, had a critical flaw that let attackers run any system command when the app starts. The issue was due to the logging configuration file being loaded without checks. It was fixed in Kedro 1.3.0.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
LinuxFoundation Kedro versions earlier than 1.3.0, used by data science teams running Kedro pipelines.
Real-world impact
An attacker who can influence the KEDRO_LOGGING_CONFIG environment variable can execute arbitrary commands on the host machine during Kedro startup, potentially taking full control of the system.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable remotely with no authentication, no user interaction, and can compromise confidentiality, integrity, and availability. The high impact and low effort required make it critical.
What to do about it
- 011. Upgrade Kedro to version 1.3.0 or later.
- 022. Restart the Kedro application to apply the new configuration.
NVD-referenced vendor advisory
Timeline
- Apr 6, 2026 · Apr 6, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/kedro-org/kedro/security/ad…vendor advisory