Elastic Patches Two Kibana Flaws — SSRF (CVE-2025-37734) and XSS (CVE-2025-59840) Flaws Affect Multiple Versions

Elastic has issued advisories for two Kibana flaws—CVE-2025-37734 and CVE-2025-59840—that could enable server-side request forgery and DOM-based cross-site scripting across multiple Kibana versions in both Elastic Cloud and self-hosted environments.

The first flaw, CVE-2025-37734, is an Origin Validation Error that could allow SSRF via a forged Origin HTTP header processed by the Observability AI Assistant, while the second, CVE-2025-59840, stems from improper input sanitisation in Kibana’s Vega visualisation engine and can lead to DOM-based XSS in the victim’s browser. Elastic notes that Vega visualisations are enabled by default, meaning nearly all Kibana instances may be at risk unless administrators disable the feature.

The recommended patched versions are 8.19.7, 9.1.7, or 9.2.1. For those unable to update immediately, interim mitigations include disabling Vega visualisations by setting vis_type_vega.enabled: false in self-hosted Kibana, and Elastic Cloud users can contact Elastic Support to request Vega visualisations be disabled in deployments, according to Elastic’s advisory.