PT-2026-60492 · Microsoft · Kiota

CVE-2026-59867 · Published 2026-07-16 · Updated 2026-07-16

NVD

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing kiota generate on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE KIOTA PROP or Leaked into generated clients. This issue is fixed in version 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.

Fix

Path traversal

SSRF

Weakness Enumeration

CWE-22

CWE-918

CWE-829

Related Identifiers

CVE-2026-59867

Affected Products

Kiota

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-59867 · Security Note
• https://github.com/microsoft/kiota/commit/cccd798027f0a20db796b3df6c64f9897a39d7b1 · Note
• https://github.com/microsoft/kiota/pull/7888 · Note
• https://github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8 · Note
• https://github.com/microsoft/kiota/releases/tag/v1.32.5 · Note