CVE-2026-26938: Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)

Published Feb 26, 2026

Updated

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.

Affected Software

2 affected components

Elastic Kibana

Elastic Kibana=9.3.0

Event History

Feb 26, 2026

CVE Published

via MITRE·05:56 PM

Data Sourced

via MITRE·05:56 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:32 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-26938?

CVE-2026-26938 is considered a critical vulnerability that can lead to unauthorized file access and SSRF attacks.

How do I fix CVE-2026-26938?

To fix CVE-2026-26938, upgrade to the latest version of Kibana where the vulnerability has been patched.

Who is affected by CVE-2026-26938?

Users of Elastic Kibana with versions vulnerable to improper neutralization of special elements in templates are affected by CVE-2026-26938.

What type of attacks can be executed due to CVE-2026-26938?

CVE-2026-26938 may allow attackers to read arbitrary files from the server filesystem and perform Server-Side Request Forgery (SSRF) attacks.

Is authentication required to exploit CVE-2026-26938?

Yes, exploiting CVE-2026-26938 requires authentication to the Kibana server.