Volerion logoVolerion
Volerion logoVolerion

Elastic Kibana Server-Side Request Forgery Vulnerability Allowing Unauthorized Network Access

Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Elastic Kibana. This issue allows authenticated users with connector management privileges to bypass the connection allowlist configured by operators. By setting up a Webhook connector with a manipulated target, an attacker can trick Kibana into sending outbound requests to blocked destinations, circumventing egress restrictions.

Impact

Exploitation of this vulnerability could lead to unauthorized network access, allowing attackers to interact with internal services or systems that are normally protected by egress controls.

Remediation

Users can upgrade to Kibana versions 9.2.8 or 9.3.2 to address this vulnerability. For those using Elastic Cloud Serverless, the vulnerability has already been remediated.

Added: May 28, 2026, 9:58 PM
Updated: May 28, 2026, 9:58 PM

Vulnerability Rating

Custom Algorithm
spread
5.7
impact
0.6
exploitability
4.3
remediation
7.7
relevance
9.2
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.