Origin Validation Error in Kibana Affects Elastic
CVE-2025-37734

4.3MEDIUM

Key Information:

Vendor

Elastic
Status
Kibana
Vendor
CVE Published:
12 November 2025

What is CVE-2025-37734?

An origin validation error in Kibana could potentially allow an attacker to perform server-side request forgery (SSRF) by sending a maliciously crafted Origin HTTP header to the Observability AI Assistant, leading to unauthorized access or actions within the server environment.

Affected Version(s)

Kibana 8.12.0 <= 8.19.6

Kibana 9.1.0 <= 9.1.6

Kibana 9.2.0

References

https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.