Executive brief
Kibana is a data visualization and management platform for the Elastic Stack. A security flaw allows authorized users with connector management permissions to bypass network security rules that restrict where the server can send data. This could allow an attacker to probe internal network services or send unauthorized requests to external systems that were supposed to be blocked by the administrator.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in Kibana's connector management component. When the 'xpack.actions.allowedHosts' setting is configured with specific host restrictions (non-wildcard), an authenticated user with privileges to manage connectors can bypass these egress controls. This allows the attacker to force the Kibana server to initiate outbound network requests to unauthorized destinations. The vulnerability affects versions 9.3.0 through 9.3.2 and is remediated in version 9.3.3. Deployments using the default wildcard allowlist are not affected by this specific bypass.
Affected products
- Elastic Kibana 9.3.0 to 9.3.2
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-05-28: patched: Fixed in version 9.3.3