CVE-2025-37734: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

PriorityP420medium4.3CVSS 3.1

AVNACLPRLUINSUCNILAN

EPSS

0.20%

9.7th percentile

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
elastic	kibana	—	—
elastic	kibana	>= 8.12.0 < 8.19.7	8.19.7
elastic	kibana	8.12.0 – 8.19.6	—
elastic	kibana	>= 9.1.0 < 9.1.7	9.1.7
elastic	kibana	9.1.0 – 9.1.6	—

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vendor_redhat4.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.