High severity7.7NVD Advisory· Published May 28, 2026· Updated Jun 1, 2026

CVE-2026-42398

Description

Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Elastic/Kibanainferred2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)
osv-coords2 versions
pkg:bitnami/elk pkg:bitnami/kibana
>= 9.0.0, < 9.2.8+ 1 more
- (no CPE)range: >= 9.0.0, < 9.2.8
- (no CPE)range: >= 9.0.0, < 9.2.8

Patches

Vulnerability mechanics

References

discuss.elastic.co/t/kibana-9-2-8-and-9-3-2-security-update-esa-2026-37/386557nvdVendor Advisory

News mentions

Kibana: Elastic Discloses 10 CVEs in a Single Day — SSRF, DoS, and Privilege Escalation
Vypr Intelligence · May 28, 2026

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000