The vulnerability arises from a combination of external control of file name or path (CWE‑73) and server‑side request forgery (CWE‑918). An attacker who can create or modify the Google Gemini connector configuration can craft a credentials JSON payload that causes the Kibana server to read arbitrary files from the file system or initiate unauthorized network requests. The result is a breach of confidentiality for files that can be accessed by the web process, potentially exposing sensitive configuration data such as credentials.

The flaw affects Elastic Kibana deployments that incorporate the Google Gemini connector. No specific patch versions are listed in the vendor advisory, which implies that all versions using the connector are vulnerable until a corresponding security update is installed. Administrators should review their Kibana installations to confirm whether the connector is present and operating.

The CVSS v3.1 score of 8.6 classifies the vulnerability as high severity. The EPSS score of less than 1 % indicates a low probability of exploitation at the time of analysis, and the vulnerability is not included in the CISA KEV catalog. Exploitation requires authenticated write access to connector configurations, so the risk is significant for environments where privileged roles are broad or poorly segregated. Attackers could therefore leverage the flaw to exfiltrate arbitrary files or trigger outbound network traffic from the Kibana host.