# CVE-2024-43710: Kibana server-side request forgery

> CVE-2024-43710: Kibana server-side request forgery. CVSS 4.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2024-43710
Last updated: 2026-06-17T07:51:35Z

- Published: 2025-01-23 06:06 UTC · Updated: 2026-06-17 07:51 UTC · Assigner: elastic
- CVSS: 4.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS: 0.26%, 18th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-918

## Description

A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health\_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.

## Affected vendors and products

- Elastic: Kibana

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2024-43710)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2024-43710)
- [https://discuss.elastic.co/t/kibana-8-15-0-security-update-esa-2024-29-esa-2024-30/373521](https://discuss.elastic.co/t/kibana-8-15-0-security-update-esa-2024-29-esa-2024-30/373521)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2024-43710 · Markdown: https://rewindex.com/cve/CVE-2024-43710.md · JSON: https://rewindex.com/api/v1/cves/CVE-2024-43710 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:11:22.922Z