CVE-2026-0532

External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-05/384524

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Control Externo de Nombre o Ruta de Archivo (CWE-73) combinado con Falsificación de Petición del Lado del Servidor (CWE-918) puede permitir a un atacante causar la divulgación arbitraria de archivos a través de una carga útil JSON de credenciales especialmente diseñada en la configuración del conector de Google Gemini. Esto requiere que un atacante tenga acceso autenticado con privilegios suficientes para crear o modificar conectores (Alertas y Conectores: Todos). El servidor procesa una configuración sin la validación adecuada, permitiendo peticiones de red arbitrarias y lecturas de archivos arbitrarias.

14 Jan 2026, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-14 11:15

Updated : 2026-06-17 10:10

NVD link : CVE-2026-0532

Mitre link : CVE-2026-0532

CVE.ORG link : CVE-2026-0532

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-0532", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0532", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T16:17:27.816904Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Kibana", "versions": [{"status": "affected", "version": "8.15.0", "versionType": "semver", "lessThanOrEqual": "8.19.9"}, {"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.1.9"}, {"status": "affected", "version": "9.2.0", "versionType": "semver", "lessThanOrEqual": "9.2.3"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-14T11:15:50.510", "references": [{"url": "https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-05/384524", "source": "security@elastic.co"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads."}, {"lang": "es", "value": "Control Externo de Nombre o Ruta de Archivo (CWE-73) combinado con Falsificaci\u00f3n de Petici\u00f3n del Lado del Servidor (CWE-918) puede permitir a un atacante causar la divulgaci\u00f3n arbitraria de archivos a trav\u00e9s de una carga \u00fatil JSON de credenciales especialmente dise\u00f1ada en la configuraci\u00f3n del conector de Google Gemini. Esto requiere que un atacante tenga acceso autenticado con privilegios suficientes para crear o modificar conectores (Alertas y Conectores: Todos). El servidor procesa una configuraci\u00f3n sin la validaci\u00f3n adecuada, permitiendo peticiones de red arbitrarias y lecturas de archivos arbitrarias."}], "lastModified": "2026-06-17T10:10:53.910", "sourceIdentifier": "security@elastic.co"}