CVE-2026-0532: 
Kibana vulnerability analysis and mitigation

CVE-2026-0532 is a combined External Control of File Name or Path (CWE-73) and Server-Side Request Forgery (CWE-918) vulnerability in Kibana's Google Gemini connector configuration. It allows authenticated attackers with connector management privileges to cause arbitrary file disclosure and arbitrary network requests via a specially crafted credentials JSON payload. The vulnerability affects Kibana versions 8.19, 10.9.1, 10.9.2, and 4.x. It was published on January 14, 2026, with a CVSS v3.1 base score of 8.6 (High), assigned by Elastic (Elastic Advisory).

The root cause is a lack of proper server-side validation when processing the credentials JSON payload in the Google Gemini connector configuration, classified under CWE-73 (External Control of File Name or Path) and CWE-918 (SSRF). An attacker can craft a malicious credentials payload that causes the Kibana server to make arbitrary outbound network requests (SSRF) or read arbitrary files from the local filesystem (path traversal/file disclosure). Exploitation requires authenticated access with the "Alerts & Connectors: All" privilege level — meaning the attacker must be able to create or modify connectors within Kibana (Elastic Advisory).

Successful exploitation allows an authenticated attacker to read arbitrary files from the Kibana server's filesystem, potentially exposing sensitive configuration files, credentials, private keys, or other confidential data. The SSRF component additionally enables the attacker to make the server issue arbitrary network requests, which could be used to probe internal network services, bypass firewall controls, or interact with cloud metadata endpoints. Integrity and availability are not directly impacted, but the high confidentiality impact combined with the changed scope indicates the potential for significant data exposure beyond the Kibana application boundary (Elastic Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.032%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for authenticated access with connector management privileges, limiting the attacker pool to insiders or compromised privileged accounts.

1. Reconnaissance: Identify a Kibana instance running an affected version (8.19, 10.9.1, 10.9.2, or 4.x) with the Google Gemini connector feature available.
2. Obtain privileged access: Authenticate to Kibana with an account that has the "Alerts & Connectors: All" privilege, either through legitimate credentials, credential theft, or social engineering.
3. Navigate to connector configuration: Access the Kibana Stack Management > Alerts & Connectors section and create or edit a Google Gemini connector.
4. Craft malicious credentials payload: Inject a specially crafted credentials JSON payload into the connector configuration — for SSRF, include a URL pointing to an internal resource (e.g., cloud metadata endpoint http://169.254.169.254/); for file disclosure, include a file path reference (e.g., file:///etc/passwd) exploiting the lack of path validation.
5. Trigger server-side processing: Save or test the connector configuration, causing the Kibana server to process the malicious payload without proper validation.
6. Retrieve disclosed data: Observe the server's response or error output, which may contain the contents of the targeted file or the response from the internal network resource (Elastic Advisory).

• Logs: Kibana application logs showing unusual connector creation or modification events for Google Gemini connectors by non-administrative users; error messages referencing unexpected file paths or internal URLs in connector processing logs.
• Network: Outbound HTTP requests from the Kibana server to internal IP ranges (e.g., 169.254.169.254, RFC 1918 addresses) or unexpected external endpoints originating from the Kibana process; requests using file:// URI schemes in connector test calls.
• File System: Audit logs indicating access to sensitive files (e.g., /etc/passwd, /etc/shadow, Kibana configuration files) by the Kibana service account at unusual times.
• Application: Kibana audit logs recording connector configuration changes with anomalous or encoded JSON payloads in the credentials field (Elastic Advisory).

Elastic has released patched versions of Kibana addressing this vulnerability: users should upgrade to the fixed releases referenced in the security advisory for versions 8.19, 10.9.1, 10.9.2, and 4.x. As an interim workaround, restrict the "Alerts & Connectors: All" privilege to only trusted administrators to reduce the attack surface. Additionally, audit existing Google Gemini connector configurations for suspicious or unauthorized credential payloads, and implement network segmentation to limit the Kibana server's ability to reach internal resources (Elastic Advisory).

Security news outlets including SecurityOnline, CyberSecurityNews, and CyberNoz covered this vulnerability as part of broader reporting on multiple Elastic/Kibana security fixes released simultaneously, with headlines highlighting arbitrary file reads and denial-of-service risks (SecurityOnline, CyberSecurityNews). The Belgian Centre for Cybersecurity (CCB) issued a warning advisory regarding multiple Kibana vulnerabilities including this one (CCB Advisory). Community reaction has been moderate, with the authentication prerequisite noted as a significant mitigating factor limiting the severity in practice.