CVE-2026-63142 MEDIUM

CVE-2026-63142: Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

Vendor Elastic
Product Kibana
Weakness CWE-863 · Incorrect authorization
Published July 21, 2026
Last update July 21, 2026
View on NVD All CVEs

CVSS base score

5.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

Key dates

02Disclosure timeline

July 21, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2025-13753 WP Table Builder <= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation CVE-2025-3453 Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products <= 2.7.7 - Unauthenticated Sensitive Information Exposure CVE-2024-13281 Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045 CVE-2026-1553 Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006 CVE-2026-3210 Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011