This vulnerability in Elastic Kibana (CVE-2026-42398) involves CWE-918 SSRF, where authenticated users who can manage connectors can bypass operator-configured egress restrictions. By creating a specially crafted Webhook connector, an attacker can force Kibana to make outbound network requests to destinations that should be blocked by the allowlist. This could lead to unauthorized internal network access or data exposure depending on the environment. The issue affects Kibana versions 9.0.0 and 9.3.0. The CVSS 3.1 base score is 7.7, reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. No vendor patch or official remediation level is currently published.

An attacker with authenticated access and connector management privileges can bypass egress restrictions intended to limit outbound network requests from Kibana. This could allow unauthorized access to internal or restricted network resources, potentially exposing sensitive information. The confidentiality impact is high, but there is no direct impact on integrity or availability. The vulnerability requires privileges and does not involve user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict connector management privileges to trusted users only and monitor for suspicious configuration changes. Review and tighten network egress controls where possible to limit potential abuse. Avoid exposing Kibana to untrusted users.