Kibana Vulnerabilities Expose Systems to SSRF and XSS Attacks

Elastic has released a security advisory about an origin validation error in Kibana that could expose systems to SSRF attacks, tracked as CVE-2025-37734. The vulnerability affects Kibana 8.12.0–8.19.6, 9.1.0–9.1.6, and 9.2.0, and is tied to the Observability AI Assistant component, with a CVSS score of 4.3 (Medium).

According to Elastic’s official security announcement, attackers can craft forged Origin HTTP headers to bypass security checks and perform unauthorized server-side requests, potentially enabling data exfiltration and lateral movement within networks. Elastic has released security updates addressing the flaw in three major releases, with fixed versions 8.19.7, 9.1.7, and 9.2.1; Cloud Serverless users are noted as already protected due to Elastic’s continuous deployment model.

For organisations unable to upgrade immediately, the advisory recommends temporarily disabling the Observability AI Assistant and auditing access logs for suspicious origin headers or unusual server-side requests. The article, dated 13 November 2025, emphasises upgrading affected Kibana installations to the patched versions as a priority.