Elastic Kibana
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Elastic Kibana.
Known Exploited Elastic Kibana Vulnerabilities
The following Elastic Kibana vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Kibana Arbitrary Code Execution |
Kibana contain an arbitrary code execution flaw in the Timelion visualizer. CVE-2019-7609 Exploit Probability: 95.3% |
January 10, 2022 |
The vulnerability CVE-2019-7609: Kibana Arbitrary Code Execution is in the top 1% of the currently known exploitable vulnerabilities.
By the Year
In 2026 there have been 43 vulnerabilities in Elastic Kibana with an average score of 6.2 out of ten. Last year, in 2025 Kibana had 25 security vulnerabilities published. That is, 18 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.54
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 43 | 6.16 |
| 2025 | 25 | 6.71 |
| 2024 | 8 | 6.30 |
| 2023 | 11 | 7.01 |
| 2022 | 7 | 5.53 |
| 2021 | 5 | 4.25 |
| 2020 | 6 | 6.10 |
| 2019 | 5 | 8.30 |
| 2018 | 7 | 7.16 |
It may take a day or so for new Kibana vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Elastic Kibana Security Vulnerabilities
CVE-2026-63262: Auth Bypass in Kibana Enables Cross-space Disclosure
CVE-2026-63262
4.3 - Medium
- July 21, 2026
Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.
AuthZ
Kibana ML Feature Uncontrolled Resource Consumption (CWE-400) DoS
CVE-2026-63261
6.5 - Medium
- July 21, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.
Resource Exhaustion
Kibana Uncontrolled Resource Consumption via Oversized Payload DoS
CVE-2026-63260
6.5 - Medium
- July 21, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.
Resource Exhaustion
Kibana Auth Bypass via User-Key Exposes Scheduled Query Data
CVE-2026-63259
4.3 - Medium
- July 21, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.
Insecure Direct Object Reference / IDOR
Kibana ML ACL Bypass Enables Audit & Notification Record Manipulation
CVE-2026-63145
4.3 - Medium
- July 21, 2026
Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobsincluding jobs in other spaces or belonging to other usersby leveraging Kibana's internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly.
AuthZ
Missing Auth in Kibana Unauthorized Data Disclosure
CVE-2026-63143
4.3 - Medium
- July 21, 2026
Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.
AuthZ
Kibana Reporting: Auth Bypass via Missing Disallowed Inputs (CWE-184)
CVE-2026-63142
5 - Medium
- July 21, 2026
Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.
AuthZ
Kibana Auth Bypass: Authenticated Users can Modify Cloud Connect Settings
CVE-2026-63141
6.3 - Medium
- July 21, 2026
Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.
AuthZ
Kibana Canvas Authenticated DoS via Uncontrolled Resource Consumption
CVE-2026-63139
6.5 - Medium
- July 21, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causing the Kibana server process to terminate and resulting in a denial of service for all users of the affected Kibana instance.
Resource Exhaustion
Kibana Auth Bypass via UserControlled Key (CWE639)
CVE-2026-56147
7.1 - High
- July 21, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments such as those associated with Security Solution cases without holding the privileges required to access those features.
Insecure Direct Object Reference / IDOR
Kibana Improper Access Control Enables Unauthorized Watchlist Modification
CVE-2026-56146
5.4 - Medium
- July 21, 2026
Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that should require elevated privileges. Under specific deployment conditions, this could also allow such a user to access data beyond their authorized scope.
AuthZ
DoS via Oversized Input in Kibana Entity Analytics
CVE-2026-42397
6.5 - Medium
- July 21, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive resource consumption, which may render Kibana unavailable.
Allocation of Resources Without Limits or Throttling
Kibana Confused Deputy Proxy Privilege Escalation
CVE-2026-49092
4.3 - Medium
- July 21, 2026
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.
AuthZ
Log Injection Vulnerability (CWE-117) in Kibana (Elastic)
CVE-2026-49091
8 - High
- July 01, 2026
Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.
Output Sanitization
Kibana APM Logs Leak Sensitive Headers via Log Injection (CWE-532)
CVE-2026-49088
4.4 - Medium
- July 01, 2026
Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.
Insertion of Sensitive Information into Log File
Kibana DoS via Excessive Bulk Deletion Resource Exhaustion
CVE-2026-49087
6.5 - Medium
- July 01, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable.
Allocation of Resources Without Limits or Throttling
Kibana Improper Input Validation Allows Authenticated DoS
CVE-2026-56151
6.5 - Medium
- July 01, 2026
Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is not correctly validated, which can render Fleet agent, server, and policy management functionality unavailable.
Improper Input Validation
Kibana SSRF Allowlist Bypass via Connector Permissions
CVE-2026-49093
6.3 - Medium
- May 28, 2026
Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.
SSRF
Kibana CVE-2026-49094: Auth Viewer DoS via Oversized Input
CVE-2026-49094
6.5 - Medium
- May 28, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.
Resource Exhaustion
Kibana Fleet Policy Injection Privilege Escalation
CVE-2026-49095
7.2 - High
- May 28, 2026
Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent policy configuration by injecting values into a configuration override mechanism that is not adequately validated. An attacker can cause Elastic Agents to be issued API keys with elevated Elasticsearch privileges, potentially granting unauthorized read and write access to sensitive Elasticsearch security indices beyond what is intended for the Fleet management role.
Improper Input Validation
Kibana SSRF Auth Users Bypass Egress Allowlist via Webhook Connector
CVE-2026-42398
7.7 - High
- May 28, 2026
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
SSRF
Kibana Uncontrolled Resource Consumption via Crafty Timelion Expr (CAPEC-130)
CVE-2026-42399
6.5 - Medium
- May 28, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. The resulting data structure grows without bound, exhausting available memory and causing the Kibana service to crash and become unavailable to all users.
Resource Exhaustion
Kibana Resource Exhaustion via Authenticated Compressed Payload
CVE-2026-42400
6.5 - Medium
- May 28, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumption that can result in a Kibana instance becoming unresponsive or crashing.
Resource Exhaustion
Kibana Stored XSS via Unsanitized Index Data (CWE79)
CVE-2026-42401
4.1 - Medium
- May 28, 2026
Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently sanitized. Successful exploitation could result in unauthorized UI manipulation and outbound network requests issued from the viewing user's browser session.
XSS
Kibana Token Bypass: Post-Expiration Access (CVE-2026-33463)
CVE-2026-33463
5.3 - Medium
- May 28, 2026
Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticated actor in possession of the token to retrieve the associated content after expiration.
Operation on a Resource after Expiration or Release
Kibana Uncontrolled Resource Consumption via Oversized Payload (CVE-2026-33464)
CVE-2026-33464
6.5 - Medium
- May 28, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.
Resource Exhaustion
Kibana Dashboard PKG Path Traversal Allows Admin Deletion of Arbitrary Accounts
CVE-2026-33462
4.6 - Medium
- May 28, 2026
A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.
Directory traversal
SSRF in Kibana One Workflow allows internal endpoint disclosure
CVE-2026-33458
6.8 - Medium
- April 08, 2026
Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.
SSRF
Kibana Authenticated DoS via Excessive Allocation in Automatic Import
CVE-2026-33459
6.5 - Medium
- April 08, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable, resulting in service disruption and deployment unavailability for all users.
Resource Exhaustion
Kibana Auth Bypass via Unscoped Client Leaks Cross-Space Data
CVE-2026-33460
4.3 - Medium
- April 08, 2026
Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.
AuthZ
Kibana Internal API Auth Bypass Exposing Sensitive Config Data
CVE-2026-33461
7.7 - High
- April 08, 2026
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint composes its response by fetching full configuration objects and returning them directly, bypassing the authorization checks enforced by the dedicated settings APIs.
AuthZ
CVE-2026-4498: Kibana Fleet Plugin Debug Route Privilege Abuse (CWE-250)
CVE-2026-4498
7.7 - High
- April 08, 2026
Execution with Unnecessary Privileges (CWE-250) in Kibanas Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).
Execution with Unnecessary Privileges
Kibana Timelion Plugin DOS via Overly Large Quantity Value
CVE-2026-26940
6.5 - Medium
- March 19, 2026
Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value.
Improper Validation of Specified Quantity in Input
Auth Bypass in Kibana Rule Management (CVE-2026-26939)
CVE-2026-26939
6.5 - Medium
- March 19, 2026
Missing Authorization (CWE-862) in Kibanas server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
AuthZ
Elastic Kibana Workflows RCE via ServerSide Template Injection
CVE-2026-26938
8.6 - High
- February 26, 2026
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.
1336
Kibana Timelion Uncontrolled Res. Consumption (CWE-400)
CVE-2026-26937
6.5 - Medium
- February 26, 2026
Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
Resource Exhaustion
Kibana AI Inference Engine DoS via Regex Blowup
CVE-2026-26936
4.9 - Medium
- February 26, 2026
Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).
ReDoS
Kibana DS via Improper Input Validation in Content Connectors Search Endpoint
CVE-2026-26935
6.5 - Medium
- February 26, 2026
Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
Improper Input Validation
Kibana DoS via Improper Quantity Validation
CVE-2026-26934
6.5 - Medium
- February 26, 2026
Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive or crashing.
Improper Validation of Specified Quantity in Input
Elastic Security: External Path & SSRF File Disclosure
CVE-2026-0532
8.6 - High
- January 14, 2026
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
SSRF
Kibana Email Connector CVE-2026-0543: Improper Input Validation (CWE-20)
CVE-2026-0543
6.5 - Medium
- January 13, 2026
Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.
Improper Input Validation
Elastic Kibana Fleet: Memory Exhaustion via Bulk Retrieval (CWE-770)
CVE-2026-0531
6.5 - Medium
- January 13, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users.
Allocation of Resources Without Limits or Throttling
Kibana Fleet Resource Exhaustion via Crafted Request (CVE-2026-0530)
CVE-2026-0530
6.5 - Medium
- January 13, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform redundant processing operations that continuously consume system resources until service degradation or complete unavailability occurs.
Allocation of Resources Without Limits or Throttling
Kibana Privilege Escalation via AuthBypass HTTP Request (CVE-2025-68422)
CVE-2025-68422
4.3 - Medium
- December 18, 2025
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.
AuthZ
Kibana: Improper Auth Enables Global Document Sharing (CWE-285)
CVE-2025-68386
4.3 - Medium
- December 18, 2025
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
AuthZ
Kibana Resource Leak: Authenticated DoS via Crafted HTTP (CVE-2025-68389)
CVE-2025-68389
6.5 - Medium
- December 18, 2025
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP request.
Allocation of Resources Without Limits or Throttling
Vega XSS via Vulnerable AST Evaluator
CVE-2025-68387
6.1 - Medium
- December 18, 2025
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.
XSS
Vega XSS via Input Neutralization Bypass (CVE-2025-68385)
CVE-2025-68385
7.2 - High
- December 18, 2025
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.
XSS
SAP Enterprise Portal Auth XSS via Integration Package Upload
CVE-2025-37732
5.4 - Medium
- December 15, 2025
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a users browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.
XSS
SSRF via Forged Origin Header in Kibana Observability AI Assistant
CVE-2025-37734
4.3 - Medium
- November 12, 2025
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.
Origin Validation Error
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Elastic Kibana or by Elastic? Click the Watch button to subscribe.
