CVE-2026-0532

Fixed in a distro release EPSS <1%CVSS 8.6

External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.

Published 2026-01-14 · CVE record · OSV

Products: Elastic Kibana, Logging Subsystem for Red Hat OpenShift, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift distributed tracing 3, Red Hat OpenStack Platform 16.2

Distro releases