#VU121290 Server-Side Request Forgery (SSRF) in Kibana - CVE-2026-0532
Published: January 13, 2026
Vulnerability identifier: #VU121290
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Amber
CVE-ID: CVE-2026-0532
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Kibana
Kibana
Software vendor:
Elastic Stack
Elastic Stack
Description
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted a specially crafted credentials JSON payload in the Google Gemini connector configuration and read contents of arbitrary files on the system or initiate requests to internal system.
Remediation
Install updates from vendor's website.