CVE-2026-42398 | BDVDB-2026-336153 Detail

Description#

Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-28Record published in the CVE List.
2. Version 22026-05-29Most recent update recorded in the CVE List.