A server‑side request forgery flaw in Kibana One Workflow allows an authenticated user with workflow creation and execution rights to bypass the host allowlist enforced by the Workflows Execution Engine. By making Kibana resolve arbitrary internal URLs, the attacker can read data from otherwise protected endpoints and learn internal network details, constituting an information‑disclosure vulnerability identified as CWE‑918.

The vulnerability affects Elastic's Kibana product. According to the referenced Elastic discussion forum, it applies to Kibana version 9.3.x and potentially earlier 9.x releases, but specific version information beyond that is not provided in the advisory.

The CVSS score of 6.8 reflects a moderate severity. Exploitation requires the user to be authenticated and to possess permissions to create and execute workflows, limiting the threat surface to privileged accounts. The EPSS score is not available and the issue is not listed in CISA's KEV catalog; nevertheless, the potential to expose confidential internal data warrants prompt remediation.