Control Externo del Nombre o Ruta de Archivo y Falsificación de Solicitud del Lado del Servidor (SSRF) en el Conector de Google Gemini de Kibana

The SSRF vulnerability in the Kibana Google Gemini Connector enables an attacker with sufficient privileges to create or modify connectors to trigger arbitrary file reads on the server. By manipulating the credentials JSON payload, an attacker can craft requests that bypass intended security controls and access sensitive files. This could lead to the exposure of configuration files, internal documents, or other confidential data stored on the Kibana server. The potential blast radius extends to any data accessible by the Kibana server's file system, depending on the attacker's privileges and the server's configuration.

Organizations utilizing the Kibana Google Gemini Connector, particularly those with lax access controls on connector creation and modification privileges, are at significant risk. Shared hosting environments where multiple users can create connectors are also particularly vulnerable.

• linux / server:

journalctl -u kibana | grep -i "gemini connector"

• generic web:

curl -I 'http://your-kibana-url/api/connectors' | grep -i 'server' # Check for unusual server headers

1. 2026-01-14Disclosure

   disclosure

1. Reservado2025-12-19
2. Publicada2026-01-14
3. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-0532 is to upgrade Kibana to version 8.19.10 or later. If immediate upgrading is not possible, restrict access to connector creation and modification functionalities to authorized users only. Implement strict input validation on all connector configuration data, specifically scrutinizing the credentials JSON payload for malicious patterns. Consider using a Web Application Firewall (WAF) to filter out potentially malicious requests targeting the connector endpoint. After upgrading, confirm the fix by attempting to create a connector with a crafted payload designed to trigger the SSRF vulnerability; the request should be rejected.