Executive brief
Kibana is a data visualization and management platform for the Elastic Stack. A security flaw allows authorized users to bypass network restrictions intended to limit where Kibana can send data. By exploiting this, an attacker could force the server to communicate with internal systems or external websites that should be blocked, potentially leading to the exposure of sensitive internal information.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in Kibana's connector management component. Authenticated users with privileges to manage connectors can bypass the 'xpack.actions.allowedHosts' configuration by crafting a specific target for a Webhook connector. This allows the attacker to force the Kibana server to initiate outbound requests to restricted destinations. The vulnerability affects Kibana versions 9.0.0 through 9.2.7 and 9.3.0 through 9.3.1. It has been patched in versions 9.2.8 and 9.3.2.
Affected products
- Elastic Kibana 9.0.0 to 9.2.7, 9.3.0 to 9.3.1
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-05-28: patched: Fixed in versions 9.2.8 and 9.3.2