Server‑Side Request Forgery in Kibana allows an attacker who has authenticated access with connector‑management privileges to override the operator‑configured linkage restriction list. By crafting a Webhook connector pointed at a non‑approved target, the victim can cause Kibana to generate HTTP requests to arbitrary internal destinations. This capability can expose confidential data, allow lateral movement, or permit exfiltration without the requester’s knowledge.

Elastic’s Kibana product is affected. No specific versions were supplied in the advisory, therefore any Kibana installation with the connector‑management feature enabled is potentially vulnerable and should be treated as impacted until a patch is applied.

The CVSS score of 7.7 classifies the flaw as high severity. Because exploitation requires a valid authenticated session with appropriate privileges, the attack surface is limited to users who already have a foothold in Kibana. The EPSS score is unavailable, but the lack of a KEV listing suggests no publicly known remote exploitation at the time. Nonetheless, the ability to bypass egress controls presents a serious threat to internal network integrity.