What’s Vulnerable › Vulnerabilities
CVE-2026-63142: Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery
- Severity: medium (CVSS 5.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-21 · updated 2026-10-24
- Weakness: CWE-863
Description
Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.
Affected products
- Kibana: from 8.0.0 before 8.19.19; from 9.0.0 before 9.3.8; from 9.4.0 before 9.4.4 — fixed in 8.19.19, 9.3.8, 9.4.4
How to fix
Upgrade to a fixed version: Kibana 8.19.19, 9.3.8, 9.4.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-63142 or the next vulnerability affects your stack