CVE-2026-0532 External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector
Authenticated attackers can exploit SSRF and path traversal in the Kibana Google Gemini connector to disclose arbitrary files and make internal network requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-0532?
CVE-2026-0532 is a high-severity server-side request forgery vulnerability in Elastic Kibana, published on 14 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
Weakness: CWE-918
Which versions are affected by CVE-2026-0532?
2 open source packages ship an affected version, including kibana and elk.
| Package | Affected | Fixed in |
|---|---|---|
kibana Bitnami | All versions | 8.19.10, 9.1.10, 9.2.4 |
elk Bitnami | All versions | 8.19.10, 9.1.10, 9.2.4 |
How do I fix CVE-2026-0532?
Upgrade kibana to a fixed version for your release line: 8.19.10, 9.1.10 or 9.2.4.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-0532 being exploited?
There is no known exploitation of CVE-2026-0532 in the wild and no public exploit code.
Sources
Also known as BIT-elk-2026-0532, BIT-kibana-2026-0532, GHSA-pgjq-pwjv-wjpx, MINI-55jv-jc63-6mfw, MINI-789q-rv6c-c7m8, MINI-8982-5qpp-qgf2 and 3 more.