Kibana CVE-2026-63143

Exploitation requires a valid Kibana user account with at least limited feature privileges - unauthenticated exploitation is not possible given PR:L in the CVSS vector. The target Kibana instance must be running an affected version (9.3.0-9.3.7 or 9.4.0-9.4.3) and must have the workflow automation feature in active use, with at least one workflow configured to query data sources containing information the low-privileged user is not otherwise authorized to access. The attacker must be a member of the Kibana space where the affected workflow resides. What limits exploitation: mandatory authenticated access (a valid credential must be compromised or belong to a malicious insider); the vulnerable surface is confined to workflow execution outputs within the user's space boundary; and the practical data exposure depends entirely on what data the configured workflow steps actually return - deployments without sensitive workflow integrations face no meaningful disclosure risk.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-accessible, low-complexity flaw requiring a low-privileged account, with limited confidentiality impact and no integrity or availability dimensions. No EPSS score was provided in the source data, no CISA KEV listing exists, and no proof-of-concept is known - all signals point to no confirmed active exploitation at time of analysis. The practical risk is highly deployment-dependent: organizations that use Kibana workflow automation integrated with sensitive data sources (databases, internal APIs, credential stores) face meaningful insider-threat or post-compromise data-exfiltration exposure, while deployments that do not use workflow automation or where workflows handle only non-sensitive data face near-zero real-world impact. The PR:L requirement prevents unauthenticated mass exploitation and limits opportunistic attack surface. SSVC exploitation status is assessed as none/theoretical. The raw CVSS score is proportionate - this is not a case of a high-CVSS-but-low-real-risk inflation; the medium score accurately captures a real but bounded, authenticated-only disclosure path.

An attacker holding a low-privileged Kibana viewer account in an organization that uses workflow automation identifies a Kibana space they have access to that contains workflows querying a restricted internal database. By directly calling the workflow execution output API endpoint - bypassing the UI controls that would normally enforce authorization - the attacker retrieves the raw results of those workflow steps, gaining read access to database records they are not authorized to query through any other mechanism. No public exploit code is known; the attack requires only standard HTTP tooling and a valid low-privilege session token.