EUVD-2026-58269
GHSA-55cc-rgfq-623v
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Attacker requires a low-privilege Kibana account to plant the payload (PR:L) and victim must actively open the visualization (UI:R), with full session abuse yielding high C/I impact and no availability effect.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.
AnalysisAI
Privilege escalation in Kibana arises from insufficient CSRF protection in the Vega visualization engine, affecting all versions prior to 8.19.20 and 9.4.5. Any Kibana user with visualization creation rights can embed a specially crafted Vega specification that, when rendered by a higher-privileged user's browser, silently issues authenticated HTTP requests to Kibana under the victim's session credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: the attacker must hold a Kibana account with at minimum the 'create visualizations' permission - no higher role is needed; a victim with a higher-privilege Kibana session (such as an administrator or operator role) must open or view a dashboard or panel that renders the malicious visualization; and the victim's browser must have an active, authenticated Kibana session at the time of rendering. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) reflects a meaningful but bounded threat: the attack is network-accessible and low-complexity, but is gated by two requirements - attacker possession of a low-privilege Kibana account (PR:L) and victim interaction in the form of opening a shared dashboard (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kibana to version 8.19.20 (for users on the 8.x branch) or 9.4.5 (for users on the 9.x branch) as documented in Elastic's security advisory ESA-2026-99 at https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-99/389529. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Kibana instances in your environment and determine their current versions, then immediately restrict Vega visualization creation permissions to administrator accounts only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today