EUVD-2026-44937
GHSA-rg4h-fpcp-2qm8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
SSRF fetch gives AV:N with no auth to the tool (PR:N), but a developer must run generation on a malicious spec (UI:R); LFI yields C:H while schema inlining gives only I:L and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing kiota generate on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.
AnalysisAI
Build-time SSRF, remote file inclusion, and local file inclusion in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description force the kiota generate command to fetch arbitrary remote http(s) URLs and read local absolute or out-of-tree file paths while resolving $ref values. Because Kiota inlined those external schemas into generated clients, an attacker could exfiltrate internal endpoints or leak local file contents (e.g. REMOTE_KIOTA_PROP-style properties) into produced code. No public exploit has been identified at time of analysis; the risk is developer/CI-toolchain oriented and requires a developer to run generation against a malicious or influenced description (CVSS 7.1).
Technical ContextAI
Kiota is Microsoft's OpenAPI-based HTTP client code generator, widely used in the .NET and Microsoft Graph SDK ecosystems to turn OpenAPI/Swagger descriptions into typed API clients across languages. The flaw is a CWE-22 path-traversal / external-reference resolution issue in Kiota.Builder's stream-loading layer: when the OpenAPI parser encountered a $ref, the default DefaultStreamLoader transparently resolved and loaded the referenced resource, whether a remote http(s) URI or a local absolute/relative filesystem path outside the project tree. Because $ref targets are attacker-influenceable data inside the description document, schema resolution became an unbounded fetch/read primitive. The fix (PR #7888, commit cccd798) introduces AllowedExternalOriginsStreamLoader, which denies all external references by default and only loads origins explicitly permitted via the new --allowed-external-origins option (supporting *, full URIs, URI patterns, and path patterns).
RemediationAI
Vendor-released patch: upgrade Microsoft Kiota to 1.32.5 or later, where external references are blocked by default via AllowedExternalOriginsStreamLoader. After upgrading, only re-enable external reference loading where genuinely required by passing --allowed-external-origins with the narrowest possible allowlist (specific full URIs or paths rather than the wildcard *, which reopens the original SSRF/LFI exposure). As a general control regardless of version, treat OpenAPI descriptions from third parties as untrusted input: run generation for untrusted specs in an isolated/sandboxed CI runner with no access to internal networks or secrets, and pre-inspect descriptions for external $ref values. See advisory GHSA-rg4h-fpcp-2qm8 (https://github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8) and the release notes at https://github.com/microsoft/kiota/releases/tag/v1.32.5.
Command injection in Microsoft Kiota before 1.32.5 lets a malicious or compromised OpenAPI description dictate the insta
Path traversal and code injection in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description write
Path traversal in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description inject unvalidated `stat
We need to produce a JSON object. All fields are plain text strings. We must synthesize from all provided data. We have
We need to produce a comprehensive JSON analysis. The user asks for a senior vulnerability analyst synthesis across mult
Code injection in Microsoft Kiota Ruby code generator allows remote code execution through crafted OpenAPI specification
Code injection in Microsoft Kiota's Python client generator (versions prior to 1.32.0) allows an attacker who controls a
Code injection in Microsoft Kiota versions prior to 1.31.1 allows attackers who control or tamper with OpenAPI descripti
Arbitrary file write via path traversal in Microsoft Kiota (OpenAPI HTTP client/plugin code generator) before 1.32.5 all
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today