Description
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Kibana | 9.3.0 – ≤ 9.3.1, 9.0.0 – ≤ 9.2.7 | — |
Advisories 1
- WID-SEC-2026-1734 Kibana: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 28, 2026