CVE-2025-37734: Elastic Kibana

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

Affected products

• Elastic Kibana: from 8.12.0, before 8.19.7 (fixed in 8.19.7); from 9.1.0, before 9.1.7 (fixed in 9.1.7); version 9.2.0 only

Published 2025-11-12. Last modified 2026-06-17.