Kibana EUVD-2026-20519

The CVSS 6.3 score reflects a network-accessible vulnerability requiring authenticated access (PR:L) with high complexity (AC:H) and high confidentiality impact (C:H) but no integrity or availability impact. The high complexity requirement and authentication barrier reduce exploitation likelihood compared to unauthenticated remote vectors. However, SSRF vulnerabilities targeting internal endpoints frequently enable lateral movement and sensitive data exfiltration in networked environments. The confirmed affected versions (9.3.0-9.3.2) represent a narrow, recently-released range, suggesting this is a newly-discovered issue. Risk is elevated for organizations where Kibana users have elevated workflow privileges and where internal services are accessible from the Kibana network segment. The information-disclosure-only impact profile (no code execution or availability impact) makes this a medium-priority issue relative to critical RCE vulnerabilities, but the combination of authentication requirement evasion and data access should not be dismissed.

An authenticated Kibana user with workflow creation permissions could craft a malicious workflow definition containing a request to an internal service endpoint (e.g., a metadata service, database console, or adjacent application) that is normally blocked by the host allowlist. By exploiting the allowlist bypass, the workflow execution engine would retrieve sensitive data from the internal endpoint and return results visible to the attacker, enabling reconnaissance or credential theft. Exploitation requires valid Kibana authentication and workflow permissions but no user interaction beyond workflow submission.