Uber Kraken versions up to 0.1.29 do not properly validate the 'tag' parameter in the /tags/{tag} endpoint, enabling unauthenticated attackers to perform path traversal attacks. By including percent-encoded parent-directory segments in the tag parameter, attackers can access files outside the configured storage root that are accessible to the testfs backend process. This vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, with no privileges or user interaction required for exploitation.

An unauthenticated attacker can read arbitrary files on the system accessible to the backend process by exploiting the path traversal vulnerability. This can lead to unauthorized disclosure of sensitive information stored on the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and monitor for suspicious requests containing encoded directory traversal sequences.