CVE-2026-63142: Kibana Auth Bypass Vulnerability

CVE-2026-63142 Overview

CVE-2026-63142 affects Kibana, the visualization and reporting component of the Elastic Stack. The vulnerability stems from an Incomplete List of Disallowed Inputs [CWE-184] within the Reporting feature. An authenticated attacker with access to Reporting can bypass administrator-configured outbound request restrictions. This causes the reporting service to issue requests to network destinations that the configured security policy should block. Elastic addressed the flaw in the ESA-2026-66 security update covering Kibana 8.19.19, 9.3.8, and 9.4.4.

Critical Impact
Authenticated Kibana users with Reporting access can bypass network egress restrictions, enabling the reporting service to reach denied internal or external destinations and potentially expose limited confidential information.

Affected Products

Kibana versions prior to 8.19.19
Kibana 9.x versions prior to 9.3.8
Kibana 9.4.x versions prior to 9.4.4

Discovery Timeline

2026-07-21 - CVE-2026-63142 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63142

Vulnerability Analysis

The vulnerability resides in the Kibana Reporting subsystem, which generates PDF and PNG exports of dashboards and visualizations. Administrators can configure allow and deny lists to restrict which network destinations the reporting service may contact. The deny list implementation is incomplete, allowing an authenticated attacker to craft reporting requests that reach destinations outside the intended policy boundary. Because the flaw involves a scope change from the reporting user context to a server-side network action, it is classified as a policy bypass affecting confidentiality. The advisory also references authorization weaknesses [CWE-863] alongside the incomplete disallow list [CWE-184].

Root Cause

The reporting service validates outbound destinations against a disallow list that fails to enumerate all equivalent representations of restricted targets. Alternate hostname encodings, IP literal formats, or redirect chains can evade the filter. As a result, requests that should be denied are permitted through the server-side reporting fetch path.

Attack Vector

An attacker requires authenticated Kibana access with permission to use the Reporting feature. The attacker submits a reporting job referencing a URL or resource whose destination is technically blocked by policy but not matched by the incomplete filter. The Kibana server processes the report generation server-side and issues outbound requests to the disallowed destination. This behavior resembles a server-side request forgery pattern gated by authentication and Reporting permissions. No user interaction is required beyond the attacker's own actions, and the attack traverses the network.

No public proof-of-concept code is available. See the Elastic Security Update ESA-2026-66 for vendor technical details.

Detection Methods for CVE-2026-63142

Indicators of Compromise

Reporting job requests referencing internal IP addresses, loopback interfaces, or cloud metadata endpoints such as 169.254.169.254.
Kibana server outbound HTTP connections to destinations that should be blocked by the configured xpack.reporting allow or deny lists.
Unusual volume of report generation activity from a single authenticated user account.

Detection Strategies

Review Kibana audit logs for report_create and report_download events correlated with unexpected target URLs.
Inspect network flow logs from Kibana hosts for egress connections to destinations outside documented reporting targets.
Alert on report definitions containing URL parameters that reference private IP ranges or non-standard hostname encodings.

Monitoring Recommendations

Enable Kibana audit logging and forward events to a centralized log platform for correlation with network telemetry.
Baseline expected outbound destinations from Kibana reporting hosts and alert on deviations.
Monitor authentication events for accounts holding the Reporting privilege and flag privilege changes.

How to Mitigate CVE-2026-63142

Immediate Actions Required

Upgrade Kibana to version 8.19.19, 9.3.8, or 9.4.4 as described in Elastic advisory ESA-2026-66.
Audit which users and roles have access to the Reporting feature and remove unnecessary grants.
Restrict Kibana server egress at the network layer to only the destinations required for legitimate reporting.

Patch Information

Elastic released fixed versions Kibana 8.19.19, 9.3.8, and 9.4.4. Refer to the Elastic Security Update ESA-2026-66 for full remediation guidance and upgrade instructions.

Workarounds

Enforce network egress filtering at the firewall or proxy layer to block Kibana reporting hosts from reaching sensitive internal endpoints and cloud metadata services.
Restrict Reporting role assignment to a minimal set of trusted users until the patch is applied.
Place Kibana in a network segment that does not have direct access to internal management interfaces or metadata services.

bash

# Example: restrict Kibana host egress with iptables to block cloud metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP