CVEvulnerability

CVE-2026-63142

5.0 MEDIUM Published 2026-07-21 Modified 2026-10-24 Official page ↗
Status
Analyzed
Published
2026-07-21
Last modified
2026-10-24
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.0 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-863

Description

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

Affected configurations

• elastic kibana (>= 8.0.0 < 8.19.19) • elastic kibana (>= 9.0.0 < 9.3.8) • elastic kibana (>= 9.4.0 < 9.4.4)

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References