CVE-2026-59867: Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
(updated )
Microsoft Kiota resolved OpenAPI $refs by fetching remote http(s) URLs and reading local files
(including absolute / out-of-tree paths), inlining the referenced schema into the generated client.
Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary
local file yielded SSRF, remote file inclusion, and local file inclusion. Verified on 1.32.3 / 1.32.4.
References
- github.com/advisories/GHSA-rg4h-fpcp-2qm8
- github.com/microsoft/kiota/commit/cccd798027f0a20db796b3df6c64f9897a39d7b1
- github.com/microsoft/kiota/pull/7888
- github.com/microsoft/kiota/releases/tag/v1.32.5
- github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8
- nvd.nist.gov/vuln/detail/CVE-2026-59867
Code Behaviors & Features
Detect and mitigate CVE-2026-59867 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →