8.6
Élevée
CVE-2026-0532 External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker…
Description
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Kibana 9.2 | 9.2.0 → 9.2.3 | Pas de correctif indiqué |
| Kibana 9.0 | 9.0.0 → 9.1.9 | Pas de correctif indiqué |
| Kibana 8.15 | 8.15.0 → 8.19.9 | Pas de correctif indiqué |
| Red Hat OpenShift distributed tracing 3 | Versions non publiées | |
| Logging Subsystem for Red Hat OpenShift | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions non publiées | |
| Red Hat OpenStack Platform 16.2 | Versions non publiées |
Autres CVE de Kibana
Les 196 CVE de Kibana →
CVE-2026-115295
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing…
4.3
Moyenne
CVE-2026-115294
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to…
7.3
Élevée
CVE-2026-115293
Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of…
6.5
Moyenne
CVE-2026-115292
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure…
4.3
Moyenne