EUVD-2026-20519Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.
AnalysisAI
Server-Side Request Forgery in Kibana One Workflow allows authenticated users with workflow privileges to bypass host allowlist restrictions in the Workflows Execution Engine, enabling unauthorized access to sensitive internal endpoints and data disclosure. Affects Kibana versions 9.3.0 through 9.3.2. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
The vulnerability exists in Kibana's Workflows Execution Engine, which implements host allowlist validation to restrict which endpoints workflows can reach. The SSRF flaw (CWE-918) permits authenticated workflow creators to craft malicious workflow definitions that circumvent these allowlist checks, enabling arbitrary requests to internal or restricted network resources. The attack requires the attacker to possess workflow creation and execution privileges within Kibana, meaning the vulnerability is restricted to authenticated users with specific role permissions rather than unauthenticated remote attackers. CPE designation cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* confirms the Elastic Kibana product line is affected across the impacted version range.
RemediationAI
Upgrade to Kibana version 9.3.3 or later, which resolves the SSRF vulnerability in the Workflows Execution Engine. This patch remedies the allowlist bypass and restores proper host restriction enforcement. Organizations unable to immediately upgrade should restrict workflow creation and execution privileges to only trusted administrative users and monitor workflow execution logs for suspicious requests to internal endpoints. Elastic's security advisory at https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-28/385815 provides additional mitigation context.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today