Incomplete List of Disallowed Inputs in Kibana - CVE-2026-63142
Published: July 22, 2026
Vulnerability identifier: #VU139141
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63142
CWE-ID: CWE-184
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to send requests to network destinations that should be denied by the configured security policy.
The vulnerability exists due to incomplete list of disallowed inputs in the Reporting feature when processing outbound requests under the screenshotting network policy. A remote user can bypass configured outbound request restrictions to send requests to network destinations that should be denied by the configured security policy.
Only Kibana deployments with the Reporting feature enabled and custom host-based deny rules configured in the screenshotting network policy are vulnerable.
Affected software
Kibana
How to mitigate CVE-2026-63142
Install security update from vendor's website.
Kibana - addressed in versions 8.19.19, 9.3.8, 9.4.4