Get real-time updates on Telegram
CVE-2026-63142: kibana from 8.0.0 (inclusive), before 8.19.19 (exclusive), from 9.0.0 (inclusive), before 9.3.8 (exclusive), from…
CVE-2026-63142. CVSS 3.1 base score 5.0 (MEDIUM, Vendor/CNA). EPSS 0.00287 (percentile 0.20138), scored 24-Oct-2026. Fixed version: 0b6bd198d583b8566336c0db61afb70b346c6882. Fixed version: 171dd53e53c29b91f45d2d87857a3f74db48cca5. Fixed version: 77cd231096e56b56ac1d24445a9430a252622e6d. Fixed version: 9bed9b7c05fe39507eb73d1a334ca96aa0c32cee. Fixed version: e39c92c646f9a6b1e4b7b68d9f59967bb77d5732. Fixed version: 08c91e2fed2dbb7bdca4ec70b32630356bbeef07.
Affected technology
kibana · from 8.0.0 (inclusive), before 8.19.19 (exclusive)
elastic
kibana · from 9.0.0 (inclusive), before 9.3.8 (exclusive)
elastic
kibana · from 9.4.0 (inclusive), before 9.4.4 (exclusive)
elastic
Kibana · 9.4.0 through 9.4.3, 8.0.0 through 8.19.18, 9.0.0 through 9.3.7
Elastic
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
An authenticated attacker with access to the Reporting feature can bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy. Vendor/CNA’s CVSS 3.1 assessment (base score 5.0/10) rates confidentiality impact as low; integrity and availability impact as none.
- CWE
- CWE-863
- CCR priority
- 20.1 /100 (P4)
- CVSS 3.1
- 5.0 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · Vendor/CNA
- EPSS
- 0.00287 · percentile 0.20138 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
- OSV.dev · Source record · observed 2026-10-24 16:38:25.544256+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-63142.html