Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-23529 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Google BigQuery (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23529 is a vulnerability in Aiven's Google BigQuery Kafka Connect Sink connector, an implementation of a sink connector from Apache Kafka to Google BigQuery, affecting versions prior to 2.11.0. The issue stems from insufficient validation of externally sourced Google Cloud credential configurations, which are processed by Google authentication libraries during connector setup. Attackers can supply malicious credential JSON files with crafted credential_source.file paths or credential_source.url endpoints, enabling arbitrary file reads or server-side request forgery (SSRF) attacks. The vulnerability is rated 7.7 on the CVSS 3.1 scale (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and maps to CWE-73 (External Control of File Name or Path) and CWE-918 (Server-Side Request Forgery).
Exploitation requires low privileges (PR:L), typically allowing an authenticated user with access to configure the connector—such as an operator or administrator in a Kafka Connect environment—to submit a malicious credential configuration. Successful exploitation grants network-accessible attackers the ability to read arbitrary files on the host system running the connector or trigger SSRF to internal or external endpoints, achieving high confidentiality impact across the changed scope without affecting integrity or availability.
Advisories and patches recommend upgrading to version 2.11.0 of the Aiven Google BigQuery Kafka Connect Sink connector, where the fix is implemented via commit 20ea3921c6fe72d605a033c1943b20f49eaba981. Google's support bulletin (gcp-2025-005) and the GitHub security advisory (GHSA-3mg8-2g53-5gj4) detail the issue and mitigation, emphasizing validation of credential configurations prior to processing by authentication libraries.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3124
Vulnerability Data
Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to 2.11.0, there is an arbitrary file read in Google BigQuery Sink connector. Aiven's Google BigQuery Kafka Connect Sink connector requires Google…
more
Cloud credential configurations for authentication to BigQuery services. During connector configuration, users can supply credential JSON files that are processed by Google authentication libraries. The service fails to validate externally-sourced credential configurations before passing them to the authentication libraries. An attacker can exploit this by providing a malicious credential configuration containing crafted credential_source.file paths or credential_source.url endpoints, resulting in arbitrary file reads or SSRF attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2V1.3.6V1.5.3V10.4.7
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.
Input validation directly rejects or sanitizes untrusted path strings before they reach filesystem operations.
Enforces authorization checks on the actual resource accessed, blocking unauthorized files even when a malicious path is supplied.
Least-privilege limits the set of files or directories any subject can affect, shrinking the blast radius of a path-control flaw.
Boundary protection limits the network reach of server-initiated requests even if SSRF occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices include input validation and path sanitization that eliminate this weakness.
Least-privilege file authorization directly limits damage from externally controlled paths.
Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.
Vulnerability identification processes can discover and record SSRF flaws in web applications.
Network segmentation and egress controls can limit the damage from successful SSRF requests.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect path-traversal issues but does not itself implement preventive controls.
Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.
Secure development lifecycle mandates input validation and path-handling controls that directly prevent external file/path manipulation.
Application security requirements explicitly call for controls against untrusted input influencing file operations.
Secure architecture principles discourage unsafe path construction but do not prescribe concrete file-name controls.
Secure coding standards require canonicalization, allow-listing, and bounds checks on file paths, directly eliminating CWE-73.