Bug 2429540 (CVE-2026-0532) - CVE-2026-0532 Kibana: Kibana: Arbitrary file disclosure via specially crafted connector configuration
Summary: CVE-2026-0532 Kibana: Kibana: Arbitrary file disclosure via specially crafted...
Keywords:
Status: NEW
Alias: CVE-2026-0532
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-01-14 11:01 UTC by OSIDB Bzimport
Modified: 2026-01-16 08:33 UTC (History)
29 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-01-14 11:01:15 UTC 
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
Note You need to log in before you can comment on or make changes to this bug.