What is GHSA-mq6c-w86q-vpp3?

GHSA-mq6c-w86q-vpp3 is a security advisory published by GitHub Security Advisories with Medium severity. Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with...

Which CVE IDs does GHSA-mq6c-w86q-vpp3 cover?

GHSA-mq6c-w86q-vpp3 covers the following CVE IDs: CVE-2026-63142. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mq6c-w86q-vpp3?

GHSA-mq6c-w86q-vpp3 has a CVSS v3 base score of 5.0, published by GitHub Security Advisories.

GHSA-mq6c-w86q-vpp3MediumCVSS 5.0

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with...

Vendor

GitHub Security Advisories

Published

July 22, 2026

Last Modified

July 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-63142 →

📋 Description

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-63142
https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568
https://github.com/advisories/GHSA-mq6c-w86q-vpp3