CVE-2026-59863
No KEV entry is attached to this observation; this is not evidence that exploitation is absent.
FIRST EPSS: 1.37 % · percentile 71.83 % · scored 26 Oct 2026.
Observed 27 Oct 2026 00:23:05 UTC · Complete immutable risk JSON
GHSA-4rj6-vrwv-wr8mPublished
Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Collected exploitation and prediction evidence
Risk source coverageCISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
Dated risk observations
Risk history is separate from CNA/OSV content history. Daily score drift is retained but only an upward crossing of 10% triggers the prediction change event.
CVE-2026-59863 · 27 Oct 2026 00:23:05 UTC
CVE-2026-59863 · 25 Oct 2026 15:18:41 UTC
Immutable source observations
3 recorded revisionsEach citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.
25 Oct 2026 14:19:22 UTC
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client gener…
nvd · CVE-2026-59863 · Published
23 Oct 2026 16:01:25 UTC
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
osv · GHSA-4rj6-vrwv-wr8m · Published
23 Oct 2026 15:48:27 UTC
Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF
cve-program · CVE-2026-59863 · Published