CVE-2026-59867
- Source
- https://cve.org/CVERecord?id=CVE-2026-59867
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59867.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-59867
- Aliases
- Published
- 2026-07-16T14:48:11.958Z
- Modified
- 2026-08-19T09:06:20.276069Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
- Details
-
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing
kiota generateon an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTEKIOTAPROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option. - Database specific
{ "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59867.json", "cwe_ids": [ "CWE-22", "CWE-829", "CWE-918" ] }- References
-
- https://github.com/microsoft/kiota/releases/tag/v1.32.5
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59867.json
- https://github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8
- https://nvd.nist.gov/vuln/detail/CVE-2026-59867
- https://github.com/microsoft/kiota/commit/cccd798027f0a20db796b3df6c64f9897a39d7b1
- https://github.com/microsoft/kiota/pull/7888
Affected packages
Git / github.com/microsoft/kiota
Affected ranges
- Type
- GIT
- Repo
- https://github.com/microsoft/kiota
- Events
-
IntroducedIntroduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixedFixed
- Database specific
-
Show details
{ "source": [ "AFFECTED_FIELD", "REFERENCES" ], "extracted_events": [ { "introduced": "1.30.0" }, { "fixed": "1.31.1" }, { "introduced": "0" }, { "fixed": "1.29.1" } ] }
Affected versions
v0.*
v0.0.10
v0.0.11
v0.0.12
v0.0.13
v0.0.14
v0.0.15
v0.0.16
v0.0.17
v0.0.18
v0.0.19
v0.0.2
v0.0.20
v0.0.21
v0.0.22
v0.0.23
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.10.0
v0.11.0
v0.11.1
v0.2.0
v0.2.1
v0.3.0
v0.4.0
v0.5.0
v0.5.1
v0.6.0
v0.7.0
v0.7.1
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.9.0
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.10.0
v1.10.0-preview.202312220001
v1.10.1
v1.11.0
v1.11.0-preview.202401300001
v1.11.1
v1.11.1-preview.202402080001
v1.11.1-preview.202402150001
v1.11.1-preview.202402220001
v1.12
v1.12.0
v1.12.0-preview.202402220002
v1.12.0-preview.202402290001
v1.13.0
v1.13.0-preview.202403210001
v1.13.0-preview.202403280001
v1.14.0
v1.14.0-preview.202404120001
v1.14.0-preview.202404180001
v1.14.0-preview.202404250001
v1.15.0
v1.15.0-preview.202405090001
v1.15.0-preview.202405160001
v1.15.0-preview.202405230001
v1.15.0-preview.202405310001
v1.16.0
v1.16.0-preview.202406130001
v1.16.0-preview.202406210001
v1.16.0-preview.202406270001
v1.17.0
v1.17.0-preview.202408010001
v1.18.0
v1.18.0-preview.202408150001
v1.18.0-preview.202408220001
v1.18.0-preview.202408290001
v1.19.0
v1.19.0-preview.202409120001
v1.19.0-preview.202409200001
v1.19.0-preview.202409200002
v1.19.0-preview.202409260001
v1.19.1
v1.2.0
v1.2.1
v1.20.0
v1.20.0-preview.202410100001
v1.20.0-preview.202410180001
v1.20.0-preview.202410240001
v1.21.0
v1.21.0-preview.202411150001
v1.21.0-preview.202411220001
v1.21.0-preview.202411290003
v1.21.0-preview.202411290004
v1.22.0
v1.22.0-preview.202412120001
v1.22.0-preview.202412190001
v1.22.0-preview.202412270001
v1.22.1
v1.22.2
v1.22.3
v1.23.0
v1.23.0-preview.202501310001
v1.24.0
v1.24.0-preview.202502270001
v1.24.0-preview.202503060001
v1.24.1
v1.24.2
v1.24.3
v1.25.1
v1.25.1-preview.202504100001
v1.25.1-preview.202504170001
v1.25.1-preview.202504240001
v1.25.1-preview.202505010001
v1.26.0
v1.26.1
v1.27.0
v1.27.0-preview.202505220001
v1.27.0-preview.202505290001
v1.27.0-preview.202506050001
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.31.1
v1.32.0
v1.32.1
v1.32.2
v1.32.3
v1.32.4
v1.4.0
v1.5.0
v1.5.0-preview.202307170006
v1.5.0-preview.202307200001
v1.5.0-preview.202307270001
v1.5.0-preview.202308030001
v1.5.1
v1.6.0
v1.6.0-preview.202308240001
v1.6.0-preview.202308310001
v1.6.0-preview.202309070001
v1.6.1
v1.7.0
v1.7.0-preview.202309210001
v1.7.0-preview.202309280001
v1.8.0
v1.8.0-preview.202310120001
v1.8.0-preview.202310190001
v1.8.0-preview.202310260001
v1.8.1
v1.8.2
v1.9.0-preview.202311160001
v1.9.0-preview.202311230001
v1.9.0-preview.202311300001
v1.9.1
Database specific
vanir_signatures
[
{
"id": "CVE-2026-59867-0255b0db",
"source": "https://github.com/microsoft/kiota/commit/70cd8bcba3ff1815f93187f3eb80ef96fd194d46",
"signature_type": "Line",
"target": {
"file": "it/java/gh/src/test/java/GHAPITest.java"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"66609017551477010826143835577406265593",
"35496344713004664179944048284480170529",
"147500007851372202392601133532187874810",
"240753228186878202917022054237087631710",
"322801780681153563118919792465691120440",
"105331927903652750006918956054969541779",
"92754106178057991798446179728179208061",
"253209821667215414607528288804099395645",
"250008073155348665397373185331785853495",
"64797852886090781921647040874546962214"
]
},
"signature_version": "v1",
"deprecated": false
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59867.json"
vanir_signatures_modified
"2026-08-19T09:06:20Z"