CVE-2026-26938 — Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Requ…

CVE-2026-26938

Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF) PUBLISHED

Description (CNA)

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 9.3.0 through 9.3.0

CWE

CWE-1336

References

https://discuss.elastic.co/t/kibana-9-3-1-security-update-esa-2026-17/385253

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.