high7.7
CVE-2026-42398
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection al…
Impact
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elastic | Kibana | from 9.0.0 before 9.2.8 from 9.3.0 before 9.3.2 |