Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery (Elastic Kibana)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.29 % · percentile 21 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- elastic
- NVD status
- Analyzed
Description
Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.
Weaknesses (CWE)
- CWE-863 — Incorrect Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N | elastic |
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N | NVD · security@elastic.co (Secondary) |
European references
- ENISA EUVD · EUVD-2026-47578
- GCVE · GCVE-0-2026-63142
CERT-FR advisories
- CERTFR-2026-AVI-0906 — Multiples vulnérabilités dans les produits Elastic · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.19.19cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.3.8cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 9.4.0 < 9.4.4
Affected products
| Product | Versions |
|---|---|
| Elastic · Kibana | affected 9.4.0 ≤ 9.4.3 ; affected 8.0.0 ≤ 8.19.18 ; affected 9.0.0 ≤ 9.3.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |