Description
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Kibana | 9.3.0 – ≤ 9.3.0 | — |
Advisories 2
- NCSC-2026-0078 Kwetsbaarheden verholpen in Kibana NCSC-NL (Netherlands) · Mar 5, 2026
- WID-SEC-2026-0545 Kibana: Mehrere Schwachstellen ermöglichen Denial of Service und Offenlegung von Informationen BSI CERT-Bund (WID) · Feb 26, 2026