CVE-2026-35171

OVERVIEW Kedro, a popular open-source toolbox for production-ready data science, contains a critical remote code execution vulnerability in versions prior to 1.3.0. The flaw exists in the logging configuration functionality, which loads configuration files specified via the KEDRO_LOGGING_CONFIG environment variable without proper validation. Attackers can exploit the logging schema's support for the special () key to instantiate arbitrary callables and execute system commands during application startup. SEVERITY This vulnerability presents a critical risk with a CVSS v3.1 score of 9.8. The attack requires no authentication, can be executed remotely over the network, demands minimal complexity, and requires no user interaction to trigger. The exploitation results in complete compromise of confidentiality, integrity, and availability. The root cause is unsafe use of logging.config.dictConfig() with user-controlled input, a well-understood attack pattern in Python applications. EXPLOITATION STATUS Currently, this vulnerability shows no active exploitation in the wild, with an EPSS score of 0.00137 indicating relatively low real-world exploitation probability. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, and no public exploit code has been widely distributed. However, the straightforward nature of the vulnerability and clear remediation path (update to version 1.3.0) suggest organizations should prioritize patching as a precautionary measure.