The vulnerability is a server-side request forgery (CWE‑918) in Kibana. An attacker who is authenticated and has connector‑management rights can trick the Kibana server into sending HTTP requests to arbitrary URLs, overriding the operator‑configured allowlist. This allows the attacker to reach internal or otherwise blocked destinations, potentially exfiltrating data or accessing services that should be inaccessible from the web interface.

The affected product is Elastic Kibana. Versions lacking the recent security update that removes the allowlist bypass are vulnerable. The information does not specify a minimum version, so any deployment of Kibana in which connector‑management privileges can be assigned should be considered susceptible until patched.

The CVSS score of 6.3 indicates moderate severity. Because the EPSS score is not available, the likelihood of exploitation cannot be measured precisely, but the fact that the flaw requires privileged access inside Kibana implies a lower probability in loosely secured installations. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to authenticate to Kibana, exercise a connector‑management operation that triggers an outbound request, and ensure that the target is reachable from the Kibana server, thereby circumventing any egress filtering that relies on the internal policy.