CVE-2026-63142CWE-863broken-access-control

CVE-2026-63142

Medium · published July 22, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-22T03:18Z
Affected products (3)
ProductVersionsFixed in
elastic/kibana≥ 8.0.0, < 8.19.198.19.19
elastic/kibana≥ 9.0.0, < 9.3.89.3.8
elastic/kibana≥ 9.4.0, < 9.4.49.4.4
References (1)
https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568 · [email protected]
EPSS history
Timeline
  • 21 JUL 22:04Z
    Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery
    cvelistv5