Uber vulnerabilities
We track 2 vulnerabilities in Uber products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest Uber vulnerabilities
- 7.5 High severity
kraken: Improper Limitation of a Pathname to a Restricted Directory
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to
- 9.0 Critical severity
kraken: Improper Validation of Integrity Check Value
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers