CVE-2026-63142 — Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery
Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configu…
Published: 2026-07-21 · CVSS: 5.0 · CVSS 3.1
Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7