Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚠️ Vulnerabilidades en productos Elastic ❗ CVE-2026-49095 ❗ CVE-2026-42398 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-elastic-3/ https://t.co/hORnleBC0x
Post summary
The tweet announces two CVEs affecting Elastic products and directs readers to a CERT website for further information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | elastic | kibana | - | - | - |