AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2026-0532

HIGH · CVSS 8.6 EPSS 0.42%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-01-14 · Last synced 2026-08-04

CyberRota Analysis

This is a high severity vulnerability with a CVSS score of 8.6. See the original NVD description below for full technical details.

CVE
CVE-2026-0532
Severity
HIGH
CVSS
8.6
EPSS
0.42%

Original NVD Description

External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.