What is the CVSS score of CVE-2026-49093?

CVE-2026-49093 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Kibana CVE-2026-49093

EUVD-2026-33035 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-28 elastic

GHSA-qf29-h8cg-2hg4

SSRF Elastic

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 21:30 vuln.today

DescriptionCVE.org

Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.

AnalysisAI

Server-Side Request Forgery in Kibana allows an authenticated user holding connector management privileges to bypass the operator-configured connector allowlist, forcing the Kibana server to issue outbound HTTP requests to destinations that egress controls were explicitly designed to block. The CVSS Changed Scope (S:C) combined with high confidentiality impact (C:H) means successful exploitation extends beyond Kibana itself, potentially exposing sensitive internal network resources such as cloud metadata services or internal APIs reachable from the Kibana host. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Kibana (cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*) is Elastic's browser-based analytics and visualization platform. Its connector subsystem allows Kibana to integrate with external services - webhooks, email providers, ticketing systems, and similar - and operators can define an allowlist of permitted outbound destinations to enforce egress boundaries. CWE-918 (Server-Side Request Forgery) describes the root cause: user-controlled input reaches server-side HTTP request logic without sufficient validation, enabling an attacker to redirect the server's outbound calls to unintended targets. In this case the allowlist bypass specifically undermines an operator-level security control, meaning the vulnerability crosses a trust boundary between the application tier and the network perimeter, which is reflected in the Changed Scope (S:C) element of the CVSS vector.

RemediationAI

The primary fix is upgrading Kibana to version 9.3.3 or later, per Elastic security advisory ESA-2026-40 at https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-40/386562. If immediate patching is not feasible, restrict connector management privileges to a minimal set of highly trusted administrators - this directly reduces the population of accounts that could trigger the bypass, though it may break existing automation or alerting workflows relying on those privileges. As a complementary control, enforce egress filtering at the network or infrastructure layer (firewall ACLs or proxy policy) independent of Kibana's application-level allowlist; network-layer controls cannot be bypassed via application-layer SSRF and provide defense-in-depth regardless of patch status. Note that the exact fix version (9.3.3) is inferred from the advisory title and should be confirmed against the full Elastic advisory before deployment.