Aller au contenu
en Se connecter
8.6 Élevée

CVE-2026-0532 External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker…

Description

External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.

Produits et versions touchés

Produit Versions touchées Corrigé en
Kibana 9.2 9.2.0 → 9.2.3 Pas de correctif indiqué
Kibana 9.0 9.0.0 → 9.1.9 Pas de correctif indiqué
Kibana 8.15 8.15.0 → 8.19.9 Pas de correctif indiqué
Red Hat OpenShift distributed tracing 3 Versions non publiées
Logging Subsystem for Red Hat OpenShift Versions non publiées
Red Hat JBoss Enterprise Application Platform 8 Versions non publiées
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions non publiées
Red Hat OpenStack Platform 16.2 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Kibana

Les 196 CVE de Kibana →
CVE-2026-115295 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing… 4.3 Moyenne CVE-2026-115294 Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to… 7.3 Élevée CVE-2026-115293 Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of… 6.5 Moyenne CVE-2026-115292 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure… 4.3 Moyenne
Suivre cette CVE