CVE-2025-37734 — Origin Validation Error in Kibana

CWE-346 — Origin Validation Error4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.0%
top 95.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Kibana
Timeline
PublishedNov 12

Description

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDelastic/kibana8.12.0 — 8.19.7+2
▶CVEListV5elastic/kibana8.12.0 — 8.19.6+2

🔴Vulnerability Details

2
GHSA
GHSA-m9mr-r5g3-7p6r: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant↗2025-11-12
▶
CVEList
Kibana Origin Validation Error↗2025-11-12
▶

📋Vendor Advisories

1
Red Hat
kibana: Kibana: Origin Validation Error leads to Server-Side Request Forgery↗2025-11-12
▶
CVE-2025-37734 — Origin Validation Error in Elastic | cvebase