An improper neutralization vulnerability in Elastic Kibana allows authenticated attackers to perform unauthorized file reads and server-side request forgery, presenting a high risk to environment security.

The flaw is an improper neutralization of special elements in a template engine (CWE-1336) within the Workflows feature. It requires an authenticated user with the workflowsManagement:executeWorkflow privilege to successfully trigger the code injection.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files on the host filesystem and enable an attacker to pivot into internal network segments via SSRF. Given the CVSS score of 8.6, this represents a high-severity risk that could result in the compromise of credentials, configuration data, or internal service access, potentially leading to a broader system breach.

Immediate Action: Upgrade to Elastic Kibana version 9.3.1 or the latest available version as specified in the official Elastic security advisory ESA-2026-17.

Proactive Monitoring: Monitor access logs for unusual patterns involving the Workflows feature and review application logs for signs of unauthorized file access or unexpected outbound network requests originating from the Kibana server.

Compensating Controls: Restrict access to the workflowsManagement:executeWorkflow privilege to only the most trusted users and ensure the Kibana server is network-segmented to limit the impact of potential SSRF attempts.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a significant risk due to the potential for information disclosure and network pivoting. Administrators should prioritize the update to version 9.3.1 immediately to eliminate the underlying template engine flaw and ensure that user privileges are audited to adhere to the principle of least privilege.