CVE-2026-63142

Analyzed Analyzed - Analysis Complete

Incomplete List of Disallowed Inputs in Kibana

Publication date: 2026-07-21

Last updated on: 2026-08-03

Assigner: Elastic

Description

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-03

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-63142

EUVD

EUVD-2026-47578

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 8.0.0 (inc) to 8.19.19 (exc)
elastic	kibana	From 9.0.0 (inc) to 9.3.8 (exc)
elastic	kibana	From 9.4.0 (inc) to 9.4.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incomplete List of Disallowed Inputs (CWE-184) in Kibana. An authenticated attacker with access to the Reporting feature can bypass outbound request restrictions set by an administrator. This allows the reporting service to send requests to network destinations that should be blocked by the configured security policy.

Detection Guidance

To detect this vulnerability, check if your Kibana instance is running an affected version (8.19.18 or earlier, 9.3.7 or earlier, or 9.4.3 or earlier). Verify if the Reporting feature is enabled and if host-based deny rules in the screenshotting network policy are configured. No specific commands are provided in the resources, but monitoring outbound requests from the reporting service may help identify unauthorized network access.

Impact Analysis

An attacker could exploit this to send unauthorized outbound requests from your Kibana instance, potentially exfiltrating data or interacting with restricted internal systems. This could lead to data leaks or unauthorized network access if the attacker gains control of the reporting service.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data transfers or access to restricted systems. GDPR may be impacted if personal data is exfiltrated, while HIPAA could be compromised if protected health information is exposed through unauthorized outbound requests.

Mitigation Strategies

Disable the Reporting feature in Kibana if not required. Review and update outbound request restrictions to ensure proper network access controls are enforced. Monitor network traffic for unauthorized requests originating from the reporting service.

Hi! I’m here to help you understand CVE-2026-63142. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70