Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.
Affected Versions:
- 9.x: Version 9.3.0
Affected Configurations:
The workflows feature is turned off by default, as its in technical preview in version 9.3.0. The feature needs to be specifically enabled within Advanced Settings.
Solutions and Mitigations:
The issue is resolved in version 9.3.1.
For Users that Cannot Upgrade:
Disable workflows https://www.elastic.co/docs/explore-analyze/workflows/setup
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: High ( 8.6 ) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVE ID: CVE-2026-26938
Problem Type: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Impact: CAPEC-242 - Code Injection