CVE-2026-59867CWE-22CWE-829CWE-918path-traversalssrf

CVE-2026-59867

High · published July 16, 2026

CVSS v3.1
7.1
EPSS
2%
Percentile
83.9
In the wild
Unconfirmed
What it is

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02393 · 83.9th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-829 · Inclusion of Functionality from Untrusted Control Sphere; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-16T20:19Z
References (4)
https://github.com/microsoft/kiota/commit/cccd798027f0a20db796b3df6c64f9897a39d7b1 · [email protected]https://github.com/microsoft/kiota/pull/7888 · [email protected]https://github.com/microsoft/kiota/releases/tag/v1.32.5 · [email protected]https://github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8 · [email protected]
EPSS history
Timeline
  • 16 JUL 14:48Z
    Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
    cvelistv5