Beveiligingsadvies

CVE-2026-0532

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-01-14 10:14:57

Laatst bijgewerkt 2026-07-15 01:24:22

Toegewezen door elastic

CVSS-score 8.6

Status PUBLISHED

Beschrijving

External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.

← Alle CVE's bekijken Bekijk op cve.org ↗