CVE-2026-26938

Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)

概要

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami elk

[{"type":"SEMVER","events":[{"introduced":"9.3.0"},{"fixed":"9.3.1"}]}]

Bitnami kibana

[{"type":"SEMVER","events":[{"introduced":"9.3.0"},{"fixed":"9.3.1"}]}]

参照URL

advisory discuss.elastic.co
web nvd.nist.gov