Description
Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Kibana | 9.3.0 – ≤ 9.3.2 | — |
Advisories 1
- WID-SEC-2026-1734 Kibana: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 28, 2026