Server-Side Request Forgery (SSRF) in Kibana - CVE-2026-0532
Published: January 13, 2026
Vulnerability identifier: #VU121290
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-0532
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted a specially crafted credentials JSON payload in the Google Gemini connector configuration and read contents of arbitrary files on the system or initiate requests to internal system.
Affected software
Kibana
How to mitigate CVE-2026-0532
Install updates from vendor's website.
Kibana - addressed in versions 8.19.10, 9.1.10, 9.2.4