Kibana Crowdstrike Connector CVE-2025-37728

Requires an authenticated Kibana account with privileges to create and run connectors (Alerting/Actions/Connector management) in at least one space. A Crowdstrike connector must already be configured in a separate space so its credentials are cached. The attacker exploits the flaw by creating and running their own Crowdstrike connector in a space they legitimately access, which returns the cached credentials from the other space. Limiting factors: valid authenticated credentials and connector-creation rights are mandatory, a pre-existing Crowdstrike connector with cached credentials must exist in another space, and the deployment must use the Crowdstrike connector feature with a multi-space model - single-space or Crowdstrike-connector-free deployments are not exposed.

This is a moderate, authenticated information-disclosure flaw (CVSS 5.4) in Elastic Kibana's Crowdstrike connector, not a drop-everything emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates a network-reachable but authenticated issue requiring a valid Kibana account with connector privileges, and the scope change (S:C) reflects that credentials cross a space/tenant boundary. Exploitation status: no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV. EPSS is low at 0.23% (13th percentile), consistent with an authenticated, configuration-dependent bug that is unlikely to be mass-exploited. The signals are mutually consistent - low EPSS, no KEV, no POC, moderate CVSS, and an authentication prerequisite all point to a low-to-moderate real-world priority. The notable caveat is the downstream blast radius: although the base confidentiality impact on Kibana is rated Low, the leaked asset is Crowdstrike EDR credentials, which could grant an attacker control over security tooling - so the organizational consequence may exceed what the 5.4 score suggests. I disagree with the vendor's UI:R and I:L choices (see assessed vector); the attacker performs all steps themselves and the primary impact is confidentiality, not integrity. Prioritize patching in environments that use the Kibana Crowdstrike connector across multiple spaces with multi-tenant/least-privilege space models.

A low-privileged but authenticated Kibana user who has access to one space creates and runs a Crowdstrike connector; because connector credentials are insufficiently isolated and cached, the connector returns Crowdstrike credentials that were configured in a different space the user should not be able to reach. The attacker then reuses those leaked EDR credentials against the organization's Crowdstrike tenant. No public exploit code has been identified, but the technique is straightforward for any user with connector-creation rights.