CVE-2026-63142
Medium
Description
Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.
SeverityMedium
CVSS5.0
Exploit probability21. percentile0.3%
Product
Elastic Kibana
PublishedJul 21, 2026
First seenJul 21, 2026
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- elastic kibana8.19.19, 9.3.8, 9.4.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elastic kibana | 8.0.0 ≤ v < 8.19.19, 9.0.0 ≤ v < 9.3.8, 9.4.0 ≤ v < 9.4.4 | 8.19.19, 9.3.8, 9.4.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.