CVE-2026-26938Disclosure(elastic / kibana)

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch elastic kibana systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.

elastic CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://discuss.elastic.co/t/kibana-9-3-1-security-update-esa-2026-17/385253

Weakness type (CWE)

CWE-1336

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kibana

Threat summary

Patch or workaround signal is available
8 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 7 signals
Disclosure: 5 classified signals
General: 2 classified signals
Peaked 3d ago at 5 mentions (2026-02-26); latest day: 1
8 total mentions across 4 days

Affected systems

Vendors

elastic

Products

kibana

1 version affected across 1 product

Deep dive

Activity timeline8 mentions / 4d

Signal classification3 categories

Disclosure

562.5%

General

225.0%

Patch

112.5%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-26	5	Disclosure4General1
2026-02-27	1	Patch1
2026-03-03	1	Disclosure1
2026-03-04	1	General1

Full discourse8 posts

Autumn Good@autumn_good_35224d
Patch
Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF) CVE-2026-26938 Kibana 9.3.1 Security Update (ESA-2026-17) https://discuss.elastic.co/t/kibana-9-3-1-security-update-esa-2026-17/385253
Post summary
The advisory announces a Kibana 9.3.1 security update for CVE-2026-26938, describing a SSRF vulnerability and indicating a patch is available.
01021530
6.7K followersView on X
CVEFind.com@CveFindCom225d
Disclosure
[CVE-2026-26938: HIGH] Vulnerability (CWE-1336) in Kibana Workflows allows file reading and SSRF through Code Injection (CAPEC-242) by authenticated users with workflowsManagement:executeWorkflow privilege.#cve,CVE-2026-26938,#cybersecurity https://cvefind.com/CVE-2026-26938
Post summary
The post announces a high‑severity vulnerability in Kibana Workflows that allows authenticated users with executeWorkflow privilege to read files and perform SSRF via code injection.
0001056
585 followersView on X
CERT-PY@CERTpy219d
General
⚠️ Vulnerabilidad en productos Elastic ❗ CVE-2026-26938 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-elastic-5/ https://t.co/Pn5doXsCiH
Post summary
The post alerts to CVE-2026-26938, offering a link for further information but lacks details on exploits, patches, or technical aspects.
00000142
6.6K followersView on X
CRAC Learning - Tech@cracbot221d
Disclosure
CVE-2026-26938 (CVSS:8.6, HIGH) is Analyzed. Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which cou..https://nvd.nist.gov/vuln/detail/CVE-2026-26938 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE‑2026‑26938, a high‑severity template engine vulnerability in Kibana’s workflows, providing CVSS score and CWE reference, but offers no PoC, exploit, or patch details.
0000031
173 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds225d
Disclosure
CVE-2026-26938 Server-Side Request Forgery and Code Injection in Kibana Workflows Management https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26938
Post summary
The text references a new vulnerability (CVE-2026-26938) involving SSRF and code injection in Kibana Workflows Management, but provides no details on PoC, exploit, patch, or active exploitation.
0000043
4.0K followersView on X
CVETodo@CveTodo225d
General
**CVE-2026-26938** pertains to a security flaw in Kibana, specifically within its Workflow feature, where improper neutralization of special elements used in a template engine (CWE-1336) can lead to severe security issues. The vulnerability allows an authenticated attacker to: #Cybersecurity #CVE #HighSeverity #SecurityAlert #RemoteCodeExecution https://cvetodo.com/cve/CVE-2026-26938
Post summary
The post announces CVE‑2026‑26938, a Kibana Workflow template engine flaw that can lead to remote code execution for authenticated users, but provides no PoC, exploit, or patch details.
0000044
20 followersView on X
The Hacker Wire@TheHackerWire225d
Disclosure
🟠 CVE-2026-26938 - High Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server fil... https://www.thehackerwire.com/vulnerability/CVE-2026-26938/ https://t.co/gCpthkUdUh
Post summary
The post announces CVE-2026-26938, a high‑severity flaw in Kibana’s workflow template engine that permits arbitrary file reads from the server.
0000048
119 followersView on X
CVE@CVEnew225d
Disclosure
CVE-2026-26938 Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files f… https://www.cve.org/CVERecord?id=CVE-2026-26938
Post summary
The CVE‑2026‑26938 vulnerability in Kibana’s Workflows allows attackers to read arbitrary files due to improper neutralization of template engine elements.
0000085
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	elastic	kibana	9.3.0	-	-

Explore more

Back to dashboard elastic CVEs kibana vulnerabilities

What researchers are saying

CVE-2026-26938

CVETodo[verified]@CveTodoGeneral

The post announces CVE‑2026‑26938, a Kibana Workflow template engine flaw that can lead to remote code execution for authenticated users, but provides no PoC, exploit, or patch details.

Autumn Good@autumn_good_35Patch

The advisory announces a Kibana 9.3.1 security update for CVE-2026-26938, describing a SSRF vulnerability and indicating a patch is available.

CVEFind.com@CveFindComDisclosure

The post announces a high‑severity vulnerability in Kibana Workflows that allows authenticated users with executeWorkflow privilege to read files and perform SSRF via code injection.

CERT-PY@CERTpyGeneral

The post alerts to CVE-2026-26938, offering a link for further information but lacks details on exploits, patches, or technical aspects.

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE‑2026‑26938, a high‑severity template engine vulnerability in Kibana’s workflows, providing CVSS score and CWE reference, but offers no PoC, exploit, or patch details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text references a new vulnerability (CVE-2026-26938) involving SSRF and code injection in Kibana Workflows Management, but provides no details on PoC, exploit, patch, or active exploitation.

The Hacker Wire@TheHackerWireDisclosure

The post announces CVE-2026-26938, a high‑severity flaw in Kibana’s workflow template engine that permits arbitrary file reads from the server.

CVE@CVEnewDisclosure

The CVE‑2026‑26938 vulnerability in Kibana’s Workflows allows attackers to read arbitrary files due to improper neutralization of template engine elements.