External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector
Summary
| CVE | CVE-2026-0532 |
|---|---|
| State | PUBLISHED |
| Assigner | elastic |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-01-14 11:15:50 UTC |
| Updated | 2026-07-15 02:17:54 UTC |
| Description | External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads. |
Risk And Classification
Primary CVSS: v3.1 8.6 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS: 0.004170000 probability, percentile 0.338380000 (date 2026-07-17)
Problem Types: CWE-918 | CWE-918 CWE-918 Server-Side Request Forgery (SSRF) | CWE-918 Server-Side Request Forgery (SSRF)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 8.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| 3.1 | [email protected] | Secondary | 8.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 8.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 8.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Elastic | Kibana | affected 8.15.0 8.19.9 semver | Not specified |
| CNA | Elastic | Kibana | affected 9.0.0 9.1.9 semver | Not specified |
| CNA | Elastic | Kibana | affected 9.2.0 9.2.3 semver | Not specified |
| ADP | Red Hat | Logging Subsystem For Red Hat OpenShift | Not specified | Not specified |
| ADP | Red Hat | Logging Subsystem For Red Hat OpenShift | Not specified | Not specified |
| ADP | Red Hat | Logging Subsystem For Red Hat OpenShift | Not specified | Not specified |
| ADP | Red Hat | Red Hat JBoss Enterprise Application Platform 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Distributed Tracing 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenStack Platform 16.2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-05/384524 | [email protected] | discuss.elastic.co | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-0532 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0532.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-01-14T11:00:50.706Z | Reported to Red Hat. |
| ADP | 2026-01-14T10:14:57.415Z | Made public. |
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
There are currently no legacy QID mappings associated with this CVE.