TI-2026-42682 Aliases CVE-2026-59867 GHSA-rg4h-fpcp-2qm8

Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

LOW 36CWE-22Published 2026-07-16 · Updated 2026-08-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-829.

Summary

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02393 84th percentileScored 2026-11-07

Fix Fixed kiota (microsoft): 1.31.1, 1.29.1Microsoft.OpenApi.Kiota (NuGet): 1.32.5, 1.29.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	kiota	1.30.0 to before 1.31.1; before 1.29.1	1.31.1, 1.29.1	Patch available	CNA
—	Microsoft.OpenApi.Kiota (NuGet)	1.30.0 to before 1.32.5	1.32.5	Patch available	GHSA-rg4h-fpcp-2qm8
—	Microsoft.OpenApi.Kiota.Builder (NuGet)	1.30.0 to before 1.32.5	1.32.5	Patch available	GHSA-rg4h-fpcp-2qm8
—	Microsoft.OpenApi.Kiota (NuGet)	before 1.29.1	1.29.1	Patch available	GHSA-rg4h-fpcp-2qm8
—	Microsoft.OpenApi.Kiota.Builder (NuGet)	before 1.29.1	1.29.1	Patch available	GHSA-rg4h-fpcp-2qm8

kiota VendorMicrosoft Affected 1.30.0 to before 1.31.1; before 1.29.1 Fixed in 1.31.1, 1.29.1 Patch available CNA
Microsoft.OpenApi.Kiota (NuGet) Vendor— Affected 1.30.0 to before 1.32.5 Fixed in 1.32.5 Patch available GHSA-rg4h-fpcp-2qm8
Microsoft.OpenApi.Kiota.Builder (NuGet) Vendor— Affected 1.30.0 to before 1.32.5 Fixed in 1.32.5 Patch available GHSA-rg4h-fpcp-2qm8
Microsoft.OpenApi.Kiota (NuGet) Vendor— Affected before 1.29.1 Fixed in 1.29.1 Patch available GHSA-rg4h-fpcp-2qm8
Microsoft.OpenApi.Kiota.Builder (NuGet) Vendor— Affected before 1.29.1 Fixed in 1.29.1 Patch available GHSA-rg4h-fpcp-2qm8

Remediation

Fix · CNA kiota (microsoft) Fixed in 1.31.1, 1.29.1
Fix · GHSA-rg4h-fpcp-2qm8 Microsoft.OpenApi.Kiota (NuGet) Fixed in 1.32.5 Advisory →
Fix · GHSA-rg4h-fpcp-2qm8 Microsoft.OpenApi.Kiota.Builder (NuGet) Fixed in 1.32.5 Advisory →
Fix · GHSA-rg4h-fpcp-2qm8 Microsoft.OpenApi.Kiota (NuGet) Fixed in 1.29.1 Advisory →
Fix · GHSA-rg4h-fpcp-2qm8 Microsoft.OpenApi.Kiota.Builder (NuGet) Fixed in 1.29.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-59867
2026-10-03 Alias added: GHSA-rg4h-fpcp-2qm8

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-59867

Other 5

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences