Volerion logoVolerion
Volerion logoVolerion

Elastic Kibana Origin Validation Error Leading to Server-Side Request Forgery

Vulnerability

A vulnerability in Kibana related to origin validation can result in server-side request forgery (SSRF). This issue arises when a forged Origin HTTP header is processed by the Observability AI Assistant, allowing potentially malicious requests to be sent to internal services.

Impact

Exploitation of this vulnerability could lead to server-side request forgery, allowing an attacker to make requests to internal services on behalf of the server.

Remediation

Users are advised to upgrade to Kibana versions 8.19.7, 9.1.7, or 9.2.1. For those using Elastic Cloud Serverless, this vulnerability has already been addressed.

Added: Nov 12, 2025, 10:20 AM
Updated: Nov 12, 2025, 6:09 PM

Vulnerability Rating

Custom Algorithm
spread
5.7
impact
0.6
exploitability
4.9
remediation
7.7
relevance
1.0
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.