CVE-2026-63142 — Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

CVE-2026-63142

Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery PUBLISHED

Description (CNA)

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 9.4.0 through 9.4.3; affected 8.0.0 through 8.19.18; affected 9.0.0 through 9.3.7

CWE

CWE-863

References

https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.