CVE-2026-26938
High · 8.6CVSS
8.6
EPSS
0.4%
Published
Feb 26, 2026
CISA due date
—
The record
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-104851 fsspec is a specification and Python implementation framework for filesystem interfaces. CWE-1336
- CVE-2026-9160 Improper neutralization of special elements used in a template engine vulnerability in… CWE-1336
- CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled daily… CWE-1336
- CVE-2026-75650 Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a… CWE-1336
- CVE-2026-52762 YesWiki is a wiki system written in PHP. CWE-1336
- CVE-2026-85654 Improper neutralization of special elements used in a template engine in the CDK… CWE-1336