This vulnerability (CVE-2026-0532) in Elastic Kibana arises from improper validation of the Google Gemini connector configuration, where an attacker with sufficient privileges can submit a crafted credentials JSON payload. The flaw combines CWE-73 (External Control of File Name or Path) and CWE-918 (Server-Side Request Forgery), enabling arbitrary file disclosure and network requests from the server. Exploitation requires authenticated access with 'Alerts & Connectors: All' privileges. The CVSS 3.1 score is 8.6, indicating high severity. No known exploits in the wild have been reported. The Red Hat advisory linked does not explicitly state patch availability or remediation details.

Successful exploitation allows an attacker with authenticated and privileged access to cause the Kibana server to make arbitrary network requests and disclose arbitrary files. This can lead to sensitive information exposure. The vulnerability does not impact confidentiality, integrity, or availability beyond the described file disclosure and SSRF capabilities. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not specify an official fix or workaround. Until a patch is available, restrict access to users with privileges to create or modify connectors and monitor for suspicious configuration changes. Follow updates from Elastic and Red Hat for official remediation.