{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0532","assignerOrgId":"271b6943-45a9-4f3a-ab4e-976f3fa05b5a","state":"PUBLISHED","assignerShortName":"elastic","dateReserved":"2025-12-19T16:02:39.148Z","datePublished":"2026-01-14T10:14:57.415Z","dateUpdated":"2026-06-30T12:06:28.394Z"},"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Kibana","vendor":"Elastic","versions":[{"lessThanOrEqual":"8.19.9","status":"affected","version":"8.15.0","versionType":"semver"},{"lessThanOrEqual":"9.1.9","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThanOrEqual":"9.2.3","status":"affected","version":"9.2.0","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.</p>"}],"value":"External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads."}],"impacts":[{"capecId":"CAPEC-76","descriptions":[{"lang":"en","value":"CAPEC-76 Manipulating Web Input to File System Calls"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":8.6,"confidentialityImpact":"HIGH","integrityImpact":"NONE","scope":"CHANGED","userInteraction":"NONE","privilegesRequired":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"271b6943-45a9-4f3a-ab4e-976f3fa05b5a","shortName":"elastic","dateUpdated":"2026-01-14T10:14:57.415Z"},"references":[{"url":"https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-05/384524"}],"source":{"discovery":"Elastic"},"title":"External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector","x_generator":{"engine":"Elastic CVE Publisher 0.0.1"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-14T16:17:27.816904Z","id":"CVE-2026-0532","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-01-14T16:18:47.674Z"}},{"affected":[{"cpes":["cpe:/a:redhat:openshift_distributed_tracing:3"],"defaultStatus":"affected","product":"Red Hat OpenShift distributed tracing 3","vendor":"Red Hat"},{"cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"unaffected","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"defaultStatus":"unaffected","product":"Red Hat JBoss Enterprise Application Platform 8","vendor":"Red Hat"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"},{"cpes":["cpe:/a:redhat:openstack:16.2"],"defaultStatus":"unaffected","product":"Red Hat OpenStack Platform 16.2","vendor":"Red Hat"}],"datePublic":"2026-01-14T10:14:57.415Z","descriptions":[{"lang":"en","value":"A flaw was found in Kibana. This vulnerability allows an authenticated attacker, with privileges to create or modify connectors, to disclose arbitrary files. The attacker achieves this by submitting a specially crafted configuration for the Google Gemini connector, which the server processes without proper validation, enabling arbitrary network requests and file reads."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-0532"},{"name":"RHBZ#2429540","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429540"},{"tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0532.json"}],"timeline":[{"lang":"en","time":"2026-01-14T11:00:50.706Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-01-14T10:14:57.415Z","value":"Made public."}],"title":"Kibana: Kibana: Arbitrary file disclosure via specially crafted connector configuration","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"},"providerMetadata":{"orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","shortName":"redhat-SADP","dateUpdated":"2026-06-30T12:06:28.394Z"}}]}}