CVE-2026-42398— Elastic Kibana 安全漏洞
Possible ATT&CK Techniques 3AI
T1048 · Exfiltration Over Alternative Protocol T1557 · Adversary-in-the-Middle T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-42398の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access
ソース: CVE Program / CVE List V5
脆弱性説明
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
服务端请求伪造(SSRF)
ソース: CVE Program / CVE List V5
脆弱性タイトル
Elastic Kibana 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Elastic Kibana是Elastic公司的一个可用数据可视化仪表板软件。 Elastic Kibana存在安全漏洞，该漏洞源于服务端请求伪造，允许具有连接器管理权限的认证用户绕过操作员配置的连接白名单，通过配置特制的Webhook连接器发起出站请求。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-42398の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-42398のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-42398 厂商安全公告 (1)
Same Patch Batch · Elastic · 2026-05-28 · 10 CVEs total
| CVE-2026-49095 | 7.2 HIGH | Improper Input Validation in Kibana Fleet Leading to Privilege Escalation |
| CVE-2026-33464 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-42399 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-42400 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-49094 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-49093 | 6.3 MEDIUM | Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access |
| CVE-2026-33463 | 5.3 MEDIUM | Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized |
| CVE-2026-33462 | 4.6 MEDIUM | Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts |
| CVE-2026-42401 | 4.1 MEDIUM | Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HT |
IV. 関連脆弱性
同じ製品: Kibana
- CVE-2026-63262
Missing Authorization in Kibana Leading to Information Discl - CVE-2026-63261
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-63260
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-63259
Authorization Bypass Through User-Controlled Key in Kibana L - CVE-2026-63145
Incorrect Authorization in Kibana Leading to Machine Learnin
同じベンダー: Elastic
- CVE-2026-63263
Uncontrolled Resource Consumption in Elasticsearch Leading t - CVE-2026-63262
Missing Authorization in Kibana Leading to Information Discl - CVE-2026-63261
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-63260
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-63259
Authorization Bypass Through User-Controlled Key in Kibana L
同じ弱点: CWE-918
- CVE-2026-70467
FortiSIEM多个版本SSRF漏洞 - CVE-2026-73247
Kestra: SSRF via Pebble http() function allows unauthenticat - CVE-2026-48762
TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in - CVE-2026-73243
kkFileView: Unauthenticated SSRF via /addTask with fullfilen - CVE-2026-58639
Microsoft SharePoint Server Spoofing Vulnerability
V. CVE-2026-42398へのコメント
まだコメントはありません