CVE-2026-26938

Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)

Summary

Original description

The description as published by the source.

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami elk

[{"type":"SEMVER","events":[{"introduced":"9.3.0"},{"fixed":"9.3.1"}]}]

Bitnami kibana

[{"type":"SEMVER","events":[{"introduced":"9.3.0"},{"fixed":"9.3.1"}]}]

References

advisory discuss.elastic.co
web nvd.nist.gov