Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 28, 2026 · NIST NVD

   Detected

   Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.

2. Oct 14, 2026 · NIST NVD

   Updated

   Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.

Affected

• cpe elastic/kibanaversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-42398

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-42398

  30-day exploitation probability 0.4%

  first.org
• NIST NVDVulnerability recordCVE-2026-42398

  Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound request

  nvd.nist.gov

References

• Vendor Advisory · discuss.elastic.co