CVE-2026-59867
Received Received - Intake

Remote File Inclusion in Kiota Code Generator

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-59867
EUVD
EUVD-2026-44937

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
kiota kiota 1.32.5
microsoft kiota to 1.32.5 (inc)
microsoft openapi.kiota *
microsoft openapi.kiota.builder *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kiota is a code generator for HTTP clients based on OpenAPI specifications. Prior to version 1.32.5, it had a vulnerability where it would automatically fetch remote URLs and read local files referenced in OpenAPI $ref fields. This allowed attackers to perform build-time SSRF, remote file inclusion, and local file inclusion by manipulating the OpenAPI description used during code generation.

Detection Guidance

To detect this vulnerability, check if your Kiota version is below 1.32.5. Run: kiota --version. If the version is older, the system is vulnerable. Also inspect build logs for unexpected external resource fetches or file inclusions during OpenAPI processing.

Impact Analysis

This vulnerability could allow attackers to access internal systems via SSRF during code generation, leak sensitive files through local file inclusion, or inject untrusted content into generated clients. It primarily affects build environments using vulnerable Kiota versions and could lead to data exposure or compromised generated code.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data (potentially violating GDPR/HIPAA) through local file inclusion or SSRF. Organizations using vulnerable Kiota versions may face compliance violations if sensitive data is exposed during build processes.

Mitigation Strategies

Upgrade Kiota to version 1.32.5 or later. If upgrading is not possible, restrict external references using the --allowed-external-origins parameter to only trusted sources. Avoid using untrusted OpenAPI specifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart