CVE-2026-49093

Sažetak

Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.

Reference

CVSS

Base:	6.3
Impact:	4.0
Exploitability:	1.8

Pristup

Vektor	Složenost	Autentikacija
NETWORK	HIGH	LOW

Impact

Povjerljivost	Cjelovitost	Dostupnost
HIGH	NONE	NONE

CVSS vektor

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Zadnje važnije ažuriranje

01-06-2026 - 14:13

Objavljeno

28-05-2026 - 21:16