SEPTEMBER 9, 2026
Live Feed
Back to database
Case File

CVE-2026-59867

HIGH · CVSS 7.1 EPSS 1.92% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-16 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

Kiota versions prior to 1.32.5 are vulnerable to server-side request forgery (SSRF), remote file inclusion, and local file inclusion due to improper handling of OpenAPI $ref values, which can be exploited through attacker-controlled descriptions. This vulnerability can lead to unauthorized access to sensitive data or services during the build process. Organizations using Kiota for API client generation should prioritize upgrading to version 1.32.5 or later to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-59867
Severity
HIGH
CVSS
7.1
EPSS
1.92%

Original NVD Description

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.