Kraken

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:uber:kraken:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorUber (97d1d60b-590b-5f6c-b98b-0f9da475d9b7)
ProductKraken (c10c36d5-dc34-5fde-9c99-3a899551a5d7)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/uber/kraken purl2cpe 2026-06-01 10:11:23.276559
pkg:golang/github.com/uber/kraken purl2cpe 2026-06-01 10:11:23.276560

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-92791 vulnerable 2026-10-13 12:28:53.588199 Uber Kraken through 0.1.29 Path Traversal via tag parameter
HIGH (7.5)
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process.
Published: 2026-09-16T20:32:46.839Z
Updated: 2026-09-21T15:41:40.643Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-47747 vulnerable 2026-06-08 05:50:40.886175 Details available
kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.
Published: 2023-01-20T00:00:00.000Z
Updated: 2025-04-03T15:45:41.798Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.