CVE-2026-42398: Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove connector creation/management privileges from users who do not require them; limit connector management to a small set of trusted administrators.
Kibana (connector management) connector_management_privileges = restrict to trusted administrators - Configuration
Disable the Webhook connector if it is not required. If Webhook connectors are required, restrict who can create or modify them and validate configured target destinations.
Kibana Webhook connector enabled = false - Compensating control
Enforce network-level egress filtering (firewall, proxy, or gateway) for Kibana hosts to block outbound requests to destinations that should be disallowed, preventing SSRF-exploited outbound connections.
- Compensating control
Restrict access to the Kibana management interface to trusted IPs or networks at the network perimeter to reduce the number of accounts that can reach connector configuration functionality.
- Operational
Audit and monitor connector configuration changes and outbound requests from Kibana for suspicious activity; review recent connector creations/changes and investigate any unexpected outbound connections.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42398?
The severity of CVE-2026-42398 is high with a score of 7.7.
What type of vulnerability is CVE-2026-42398?
CVE-2026-42398 is a Server-Side Request Forgery (SSRF) vulnerability in Kibana.
How does CVE-2026-42398 affect Kibana?
CVE-2026-42398 allows authenticated users with connector management privileges to bypass the connection allowlist.
What users are impacted by CVE-2026-42398?
Authenticated users with connector management privileges are impacted by CVE-2026-42398.
How can I mitigate the risks of CVE-2026-42398?
Mitigation for CVE-2026-42398 involves ensuring proper configuration and limiting privileges for connector management in Kibana.