What is the CVSS score of EUVD-2026-47578?

EUVD-2026-47578 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Kibana EUVD-2026-47578

| CVE-2026-63142 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-21 security@elastic.co

GHSA-mq6c-w86q-vpp3

Elastic Authentication Bypass Kibana

5.0

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

5.0 MEDIUM

PR:L confirmed by requirement for authenticated Reporting access; S:C and C:L reflect SSRF reaching other network systems with limited response disclosure.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:00 vuln.today

CVE Published

Jul 21, 2026 - 23:18 cve.org

MEDIUM 5.0

DescriptionCVE.org

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

AnalysisAI

Outbound request restriction bypass in Kibana's Reporting feature enables authenticated low-privileged attackers to cause the reporting service to issue HTTP requests to network destinations explicitly denied by administrator-configured security policy. Affected versions span Kibana 8.x through 8.19.18, 9.0.x through 9.3.7, and 9.4.x through 9.4.3. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Kibana itself to internal network resources, making this a server-side request forgery (SSRF)-class issue. No public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

Kibana's Reporting feature generates PDF and CSV exports by internally dispatching HTTP requests to configured data sources and rendering URLs. Administrators can configure outbound request restrictions - a blocklist or allowlist - to prevent the reporting service from reaching unauthorized internal or external network destinations. CWE-184 (Incomplete List of Disallowed Inputs) identifies the root cause: the restriction logic fails to account for all input variations (e.g., URL encoding, alternate IP representations, redirects, or protocol variations) that can route requests past the filter. The NVD also maps this to CWE-863 (Incorrect Authorization), reflecting the policy enforcement failure as a complementary classification. Affected CPE-identified products span the 8.x line (8.0.0-8.19.18) and the 9.x line (9.0.0-9.3.7 and 9.4.0-9.4.3), as confirmed by the EUVD advisory EUVD-2026-47578.

RemediationAI

The primary remediation is to upgrade Kibana to a patched release: version 8.19.19 for 8.x deployments, 9.3.8 for 9.0.x-9.3.x deployments, or 9.4.4 for 9.4.x deployments. The Elastic advisory ESA-2026-66 at https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568 should be consulted for full upgrade instructions. As a compensating control prior to patching, administrators should restrict access to the Kibana Reporting feature to the minimum set of trusted users via Kibana role-based access control, reducing the pool of principals who can trigger the bypass. Additionally, deploying a network-layer egress filtering proxy or firewall rule enforcing the intended outbound destination policy independently of Kibana's application-layer blocklist provides defense in depth; this does not fix the vulnerability but prevents the Kibana process from reaching denied destinations even if the filter is bypassed. Note that disabling the Reporting feature entirely eliminates the attack surface but also removes legitimate functionality for all users.