VYPR
← All advisories
Medium severity5.0NVD Advisory· Published Jul 21, 2026· Updated Aug 3, 2026

CVE-2026-63142

CVE-2026-63142

Description

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Elastic/Kibana2 versions
    cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*range: >=8.0.0,<8.19.19
    • (no CPE)
  • osv-coords2 versions
    pkg:bitnami/kibanapkg:bitnami/elk
    >= 8.0.0, < 8.19.19+ 1 more
    • (no CPE)range: >= 8.0.0, < 8.19.19
    • (no CPE)range: >= 8.0.0, < 8.19.19

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.