CVE-2026-59867

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5

Description Kiota resolves OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths. When using kiota generate with an attacker-controlled or influenced description, this can lead to build-time Server-Side Request Forgery (SSRF), remote file inclusion, and local file inclusion by inlining external schemas into generated clients.

Recommendations Update to version 1.32.5 or later. Use the --allowed-external-origins option to restrict external origins.