VULNERABILITY INTELLIGENCE
CVE-2026-0532
CVSS score8.6 HIGH
EPSS probability0.49%
CISA KEVNot currently listed
Published2026-01-14
Last modified2026-07-15
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Description
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
Weakness classification
- security@elastic.co: CWE-918
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-918