# Kibana 8.19.7, 9.1.7, and 9.2.1 Security Update (ESA-2025-24)

**URL:** https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-24/383381
**Category:** Security Announcements
**Created:** [November 12, 2025, 9:41am UTC](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-24/383381 "2025-11-12T09:41:39Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)
#### Post date: [November 12, 2025, 9:41am UTC](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-24/383381/1 "2025-11-12T09:41:39Z")

</div>

**Kibana Origin Validation Error (ESA-2025-24)**

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

**Affected Versions:**

- 8.12.0 up to and including 8.19.6
- 9.1.0 up to and including 9.1.6
- 9.2.0

**Affected Configurations:**

Deployments using the Observability AI Assistant.

**Solutions and Mitigations:**

Users should upgrade to version 8.19.7, 9.1.7, and 9.2.1.

**Elastic Cloud Serverless**

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

**Severity:** CVSSv3.1: 4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

**CVE ID** : CVE-2025-37734

---

_[View the full topic](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-24/383381)._