Skip to content
fr Sign in
8.6 High

CVE-2026-0532 External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker…

Description

External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.

Affected products and versions

Product Affected versions Fixed in
Kibana 9.2 9.2.0 → 9.2.3 No fix stated
Kibana 9.0 9.0.0 → 9.1.9 No fix stated
Kibana 8.15 8.15.0 → 8.19.9 No fix stated
Red Hat OpenShift distributed tracing 3 Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenStack Platform 16.2 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Kibana

The 196 CVEs of Kibana →
CVE-2026-115295 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing… 4.3 Medium CVE-2026-115294 Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to… 7.3 High CVE-2026-115293 Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of… 6.5 Medium CVE-2026-115292 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure… 4.3 Medium
Track this CVE