CVE-2026-26938
Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)
Résumé
Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.
Paquets affectés
Bitnami
elk
[{"type":"SEMVER","events":[{"introduced":"9.3.0"},{"fixed":"9.3.1"}]}]
Bitnami
kibana
[{"type":"SEMVER","events":[{"introduced":"9.3.0"},{"fixed":"9.3.1"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- web discuss.elastic.co