This vulnerability in Elastic Kibana 9.3.0 involves CWE-918 SSRF, where an authenticated user with specific privileges can circumvent the operator-configured connector allowlist. This bypass enables the Kibana server to issue outbound requests to unauthorized destinations, potentially violating network egress policies. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects a network attack vector requiring low privileges but high attack complexity, with a significant confidentiality impact due to potential unauthorized data access or leakage.

An attacker with authenticated connector management privileges can exploit this SSRF vulnerability to make the Kibana server send requests to internal or external systems that should be blocked by egress controls. This can lead to unauthorized access to sensitive information or internal network resources. However, the vulnerability does not impact integrity or availability directly. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict connector management privileges to trusted users only and monitor for unusual outbound request activity. Avoid exposing Kibana to untrusted networks or users with connector management rights. Follow Elastic's official advisories for updates on patches or mitigations.