Kibana 9.2.8, and 9.3.2 Security Update (ESA-2026-37)

Announcements Security Announcements
1

Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access

Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.

Affected Versions:

  • 9.x:
    • All versions from 9.0.0 up to and including 9.2.7
    • All versions from 9.3.0 up to and including 9.3.1

Affected Configurations:

  • Kibana deployments where the xpack.actions.allowedHosts setting is configured to restrict outbound connector connections (i.e., not set to the wildcard value) and where users have been granted connector management privileges are affected.

Solutions and Mitigations:

The issue is resolved in versions 9.2.8, and 9.3.2.

Elastic Cloud Serverless

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

Severity: CVSSv3.1: High ( 7.7 ) - AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVE ID: CVE-2026-42398
Problem Type: CWE-918 - Server-Side Request Forgery (SSRF)