CVE-2026-42398: Elastic Kibana

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.

Affected products

• Elastic Kibana: from 9.0.0, before 9.2.8 (fixed in 9.2.8); from 9.3.0, before 9.3.2 (fixed in 9.3.2)

Published 2026-05-28. Last modified 2026-06-17.