CVE-2026-49093 MEDIUM

CVE-2026-49093: Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access

Vendor Elastic
Product Kibana
Weakness CWE-918 · SSRF
Published May 28, 2026
Last update May 29, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.

Key dates

02Disclosure timeline

May 28, 2026 CVE published
May 29, 2026 Record updated