Server‑Side Request Forgery vulnerability in Kibana One Workflow allows an authenticated user with workflow creation and execution privileges to bypass the engine’s host allowlist. The attacker can cause the system to fetch data from internal endpoints, exposing sensitive internal resources and data.

The vulnerability affects Elastic Kibana, specifically the Kibana One Workflow component. Versions in use that have not yet applied the latest security update are at risk.

The CVSS score of 6.8 indicates moderate severity. The EPSS score is below 1 percent, and the vulnerability is not listed in the CISA KEV catalog, suggesting low current exploitation likelihood. However, because the attack requires privileges within workflows, the threat level rises for organizations that give users workflow creation rights and rely on internal endpoints that should be restricted. Exploitation would enable an attacker to read internal data without additional compromise.