CVE-2026-63142

MEDIUM

Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

Title source: cna

Description

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

References (1)

Core 1

Core References

https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568

Scores

CVSS v3 5.0

EPSS 0.0018

EPSS Percentile 7.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-863

Status published

Products (3)

Elastic/Kibana 8.0.0 - 8.19.18

Elastic/Kibana 9.0.0 - 9.3.7

Elastic/Kibana 9.4.0 - 9.4.3

Published Jul 21, 2026

Tracked Since Jul 22, 2026