Kraken vulnerabilities

2 known vulnerabilities in Kraken from Uber. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  kraken: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-92791Sep 16, 2026Uber

  Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to

• 9.0 Critical severity

  kraken: Improper Validation of Integrity Check Value

  CVE-2026-75625Aug 18, 2026Uber

  Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers