CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-63142

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

Score
5.0 medium
Published
2026-07-21
Links
NVD · cve.org · Report wrong data

Matched ports (2)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.19</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.19</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an
	authenticated attacker with access to the Reporting feature to bypass
	outbound request restrictions configured by an administrator, causing
	the reporting service to send requests to network destinations that
	should be denied by the configured security policy.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-63142</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-63142</url>
    </references>
    <dates>
      <discovery>2026-07-21</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>