CVE-2026-42398: Kibana Webhook SSRF Vulnerability—Egress Allowlist Bypass

Technical summary

The vulnerability exists in Kibana's Webhook connector implementation, which fails to properly validate destination URLs against operator-configured connection allowlists when processing connector configurations. An authenticated user with connector management privileges can craft a specially formatted target URL that bypasses the intended egress restrictions (CWE-918). When the connector is triggered, Kibana will issue HTTP requests to the attacker-specified destination, treating those requests as legitimate Kibana-initiated traffic. The CVSS 3.1 score of 7.7 (HIGH) reflects the combination of network-based attack vector, low attack complexity, required authentication, and the ability to gain high confidentiality impact by accessing restricted resources from the perspective of the Kibana server.

Business impact

Organizations relying on Kibana's connector allowlist as a network security boundary are exposed to data exfiltration risks. An insider threat or compromised account with connector management permissions could weaponize this flaw to access internal systems, metadata repositories, or cloud endpoints that should be unreachable from Kibana's network segment. This is particularly concerning in environments where Kibana sits in a DMZ or restricted zone with explicit egress policies—the vulnerability enables lateral movement and reconnaissance of internal infrastructure by making requests appear to originate from a trusted application. Incident response teams may also struggle to detect such activity if request logging relies on connector audit trails rather than network monitoring.

Affected systems

Elastic Kibana is affected. The vulnerability requires authenticated access with connector management privileges, limiting the blast radius to users with legitimate Kibana administrative or connector configuration roles. Organizations should consult Elastic's official security advisory for specific version ranges impacted and patch availability. The threat model assumes an attacker has already obtained or been granted valid credentials with connector-related permissions.

Exploitability

Exploitation requires valid Kibana credentials and connector management privileges. An attacker cannot exploit this from an unauthenticated state. However, the attack complexity is low—once authenticated, the attacker simply needs to create or modify a Webhook connector with a crafted URL pointing to a restricted destination. No end-user interaction or complex steps are required. The vulnerability is reliably triggerable if the connector permissions and network path to the target destination exist, making it a practical concern for insider threats or post-compromise scenarios where credentials have been obtained.

Remediation

Apply security updates from Elastic that patch the SSRF vulnerability in Kibana's Webhook connector validation logic. The patch should enforce stricter URL validation, enforce allowlist policies at the HTTP client level, and prevent bypass techniques. Organizations should simultaneously audit existing Webhook connectors for suspicious or unusual target destinations and review access logs for connector management activity. Implement principle of least privilege by restricting connector management permissions to only necessary administrative users, and consider network-based controls (egress filtering, DNS sinkholing) as defense-in-depth measures independent of Kibana's internal controls.

Patch guidance

Contact Elastic directly or consult their security advisories for patched versions. Verify patch availability by checking the Kibana release notes and security bulletin corresponding to the publication date (May 28, 2026) and modification date (June 17, 2026). Test patches in a non-production environment before deployment to ensure compatibility with existing connectors and alerting rules. Post-patch, reconfigure or regenerate Webhook connectors to ensure they are aligned with updated validation rules.

Detection guidance

Monitor Kibana connector configuration change logs for creation or modification of Webhook connectors with non-standard or internal-only target URLs. Inspect network traffic originating from Kibana servers for unexpected outbound connections, particularly to internal IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), or previously blocked destinations. Enable verbose logging in Kibana's connector modules to capture URL parameters and request details. Correlate connector audit events with firewall and proxy logs to identify divergences between allowed and actual egress patterns.

Why prioritize this

Although marked HIGH severity with a score of 7.7, the practical risk depends heavily on organizational context. The vulnerability is not remotely exploitable by unauthenticated attackers and requires intentional abuse of legitimate connector management privileges. However, it poses a meaningful risk in zero-trust or strict egress-control environments where Kibana sits behind restrictive network policies. Prioritize this if: (1) your Kibana instances have restricted egress rules in place that you rely on for security; (2) you have users with connector management permissions who may be targeted by social engineering or credential theft; (3) sensitive internal systems are only a few network hops away from Kibana. Lower priority if Kibana already sits in an unrestricted network zone or if you have compensating controls (e.g., denial-of-service rules for internal IPs at the firewall level).

Risk score, explained

The CVSS 3.1 score of 7.7 reflects: (1) network-based attack vector (AV:N) and low attack complexity (AC:L), allowing remote exploitation once authenticated; (2) required authentication (PR:L), limiting scope to credentialed users; (3) changed scope (S:C), as requests are made on behalf of the Kibana service to other systems; (4) high confidentiality impact (C:H), enabling reconnaissance or data access to restricted internal resources; (5) no integrity or availability impact (I:N/A:N), as the attack focuses on unauthorized information disclosure and lateral movement, not data modification or system disruption.

Frequently asked questions