# Kibana 9.2.8, and 9.3.2 Security Update (ESA-2026-37) **URL:** https://discuss.elastic.co/t/kibana-9-2-8-and-9-3-2-security-update-esa-2026-37/386557 **Category:** Security Announcements **Created:** [May 28, 2026, 7:25pm UTC](https://discuss.elastic.co/t/kibana-9-2-8-and-9-3-2-security-update-esa-2026-37/386557 "2026-05-28T19:25:55Z") **Posts on this page:** 1 **Page:** 1
### Author: ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul) #### Post date: [May 28, 2026, 7:25pm UTC](https://discuss.elastic.co/t/kibana-9-2-8-and-9-3-2-security-update-esa-2026-37/386557/1 "2026-05-28T19:25:55Z")
**Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access** Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block. **Affected Versions:** - 9.x: - All versions from 9.0.0 up to and including 9.2.7 - All versions from 9.3.0 up to and including 9.3.1 **Affected Configurations:** - Kibana deployments where the `xpack.actions.allowedHosts` setting is configured to restrict outbound connector connections (i.e., not set to the wildcard value) and where users have been granted connector management privileges are affected. **Solutions and Mitigations:** The issue is resolved in versions 9.2.8, and 9.3.2. **Elastic Cloud Serverless** Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. **Severity:** CVSSv3.1: High ( 7.7 ) - AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N **CVE ID:** CVE-2026-42398 **Problem Type:** CWE-918 - Server-Side Request Forgery (SSRF)