CVE-2026-0532
8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Summary
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Elastic | Kibana | 8.15.0 <= 8.19.9 | affected |
| Elastic | Kibana | 9.0.0 <= 9.1.9 | affected |
| Elastic | Kibana | 9.2.0 <= 9.2.3 | affected |
Weaknesses
- CWE-918: CWE-918 Server-Side Request Forgery (SSRF)
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: partial
Kibana: Kibana: Arbitrary file disclosure via specially crafted connector configuration
Additional References
- https://access.redhat.com/security/cve/CVE-2026-0532
- https://bugzilla.redhat.com/show_bug.cgi?id=2429540
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0532.json
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.