Elastic Kibana CVE-2026-63141

Authentication as any valid Kibana user is required (PR:L per CVSS vector), but no elevated or administrator-level privilege is needed - the vulnerability specifically allows users without the required Cloud Connect feature privilege to access these endpoints. The Cloud Connect feature must be present in the Kibana deployment; instances that do not use or configure Cloud Connect have reduced practical impact even if the vulnerable endpoints are technically reachable. Exploitation is limited to: possession of any active Kibana user account, network access to the Kibana HTTP interface, and knowledge of the affected endpoint paths. There is no user interaction required. Non-default configurations or specific platform versions are not a prerequisite.

The CVSS 3.1 base score of 6.3 (Medium) reflects network-accessible exploitation requiring low privileges with Low C/I/A impact, consistent with an authorization bypass affecting a specific feature rather than the entire platform. No EPSS data was provided, but the absence of both CISA KEV listing and public exploit code suggests no widespread active exploitation at the time of analysis. The real-world risk is moderate: the attack surface requires a valid Kibana account, limiting opportunistic attacks, but in environments with many users or where Kibana is accessible beyond a small admin group, any authenticated user could tamper with Cloud Connect service integration settings - potentially disrupting cloud connectivity or exposing integration credentials stored in that configuration. The Integrity and Availability impacts of modifying service-level settings may exceed what the Low ratings suggest in operational terms. This is a legitimate priority for organizations using Kibana's Cloud Connect feature, though not an emergency for those who do not.

An attacker with a low-privilege Kibana user account - such as a read-only analyst or a compromised service account - directly issues HTTP requests to Kibana's Cloud Connect configuration endpoints. Without the required feature privilege checks being enforced, the server processes these requests, allowing the attacker to retrieve Cloud Connect service credentials or modify integration settings, potentially redirecting cloud telemetry or disrupting Elastic Cloud connectivity. No public exploit code is required; knowledge of the endpoint paths and a valid session token are sufficient.