PT-2026-63260 · Elastic · Kibana

CVE-2026-63142 · Publicado 2026-07-21 · Atualizado 2026-07-21

Mitre

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-63142

Produtos afetados

Kibana

Referências · 2

• https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63142 · Nota de Segurança