What is the CVSS score of CVE-2026-42398?

CVE-2026-42398 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Kibana are affected by CVE-2026-42398?

Elastic Kibana contains a server-side request forgery vulnerability (CVSS 7.7) that allows authenticated users with connector management privileges to bypass security controls and access restricted…

How to fix or mitigate CVE-2026-42398?

Within 24 hours: Audit all Kibana instances and immediately restrict connector management privileges to essential administrators only; enable comprehensive audit logging of all webhook connector creation and modification. Within 7 days: Deploy network-level egress filtering on Kibana hosts to restrict outbound traffic to authorized external destinations and block all internal network ranges (RFC 1918 addresses: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Within 30 days: Monitor vendor advisories for patch release; evaluate Kibana upgrade timeline to patched versions when available; implement permanent network segmentation isolating critical systems from Kibana infrastructure if feasible.

Kibana CVE-2026-42398

EUVD-2026-33032 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-28 elastic

GHSA-43ww-gwmw-f89v

SSRF Elastic

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 21:28 vuln.today

DescriptionCVE.org

Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.

AnalysisAI

Server-side request forgery in Elastic Kibana allows authenticated users holding connector management privileges to bypass operator-configured egress allowlists by crafting a Webhook connector with an arbitrary target. The flaw enables Kibana to issue outbound HTTP requests to internal or otherwise restricted destinations, exposing sensitive data accessible from the Kibana host. No public exploit identified at time of analysis, and the vulnerability is not present on the CISA KEV list.

Technical ContextAI

The vulnerability lives in Kibana's Actions/Connectors subsystem, specifically the Webhook connector that lets administrators wire alerting and case workflows to external HTTP endpoints. Operators can configure a connection allowlist (xpack.actions.allowedHosts / customHostSettings) intended to constrain which destinations Kibana may contact from its server-side process. CWE-918 (Server-Side Request Forgery) is the root cause class: input controlling an outbound request destination is not adequately validated against the allowlist, so a crafted connector configuration causes the Kibana node process to issue requests on behalf of the attacker to destinations the operator explicitly tried to block, including potentially cloud metadata services, internal management planes, or other intranet hosts reachable from the Kibana server.

RemediationAI

The primary fix is to upgrade Kibana to a vendor-released patched version - 9.2.8 on the 9.2 branch or 9.3.2 on the 9.3 branch, per Elastic advisory ESA-2026-37 at https://discuss.elastic.co/t/kibana-9-2-8-and-9-3-2-security-update-esa-2026-37/386557. Where immediate patching is not possible, compensating controls include revoking the connector management Kibana privilege from non-administrator roles (this disables alerting/cases connector creation for those users but contains the attack surface to fully trusted operators), placing Kibana behind an egress proxy or network firewall that enforces destination allowlisting at L3/L4 independently of Kibana's in-app allowlist (which adds operational overhead and may break legitimate webhook destinations), and blocking Kibana's outbound access to cloud instance metadata endpoints (169.254.169.254, fd00:ec2::254) and internal management CIDRs to neutralize the highest-impact SSRF pivots.