A high severity vulnerability (CVE-2026-0532) affects Kibana's Google Gemini connector, combining external control of file name/path (CWE-73) with Server-Side Request Forgery (CWE-918). Attackers with connector modification privileges can exploit this through specially crafted credentials JSON payloads to achieve arbitrary file disclosure and network requests. The vulnerability affects Kibana versions 8.15.0-8.19.9, 9.0.0-9.1.9, and 9.2.0-9.2.3. Users should upgrade to versions 8.19.10, 9.1.10, or 9.2.4, or disable the connector type as a temporary mitigation. The CVSS score is 8.6 (High), indicating significant risk to confidentiality.