CVE-2026-42398
Last modified
CVE-2026-42398 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Kibana | >= 9.0.0, < 9.2.8 |
| Elastic | Kibana | >= 9.3.0, < 9.3.2 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-42398?
How severe is CVE-2026-42398?
How do I fix CVE-2026-42398?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-42391An unauthenticated attacker can send an IMAP ID command with…7.5
- CVE-2026-42392An attacker that has valid credentials can send an invalid I…4.3
- CVE-2026-42393The comparison used for the doveadm password and API key is …3.1
- CVE-2026-42395A host listed as a trusted proxy can send forwarding informa…4.3
- CVE-2026-42396Insufficient Validation of Member Zone Data May Cause Catalo…6.5
- CVE-2026-42397Allocation of Resources Without Limits or Throttling (CWE-77…6.5
- CVE-2026-42399Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
- CVE-2026-4240A vulnerability was determined in Open5GS up to 2.7.6. The a…7.5
- CVE-2026-42400Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
- CVE-2026-42401Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2026-42402Apache Neethi is vulnerable to a Denial of Service attack th…7.5
- CVE-2026-42403Apache Neethi does not properly detect circular references i…7.5
Are you affected by CVE-2026-42398?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST