EUVD-2026-70658
GHSA-6q7w-4cg4-7827
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Fleet management credentials
-
DeliveryNavigate to Cribl integration config
-
ExploitInject malicious template expression in config field
-
ExecutionServer renders template server-side
-
ImpactUnauthorized Elasticsearch ingest pipeline written
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with Kibana Fleet management privileges (PR:L) - this is a non-default, typically administrator-adjacent role, not granted to ordinary users. The Cribl integration must be accessible and configurable within the Kibana deployment. No user interaction beyond the attacker's own actions is required. Exploitation is limited to intra-cluster integrity impact (unauthorized ingest pipeline writes); there is no confidentiality exposure and no availability impact. Deployments that do not use the Cribl integration, or that tightly scope Fleet management role assignment, are not realistically at risk. |
| Impact | The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) appropriately reflects a medium-low risk: exploitation requires valid Kibana credentials with Fleet management privileges, which are non-default and typically administrator-adjacent roles. The scope is unchanged (S:U), meaning the attacker cannot escape the Kibana/Elasticsearch cluster boundary, and there is no confidentiality or availability impact. The integrity impact (I:L) is limited to writing ingest pipelines beyond the caller's authorized scope within the same cluster. No EPSS data was provided, and this CVE is not listed in CISA KEV, indicating no confirmed active exploitation. The 'RCE' tag in the input metadata is misleading - the actual impact is unauthorized pipeline writes, not remote code execution; CVSS C:N/I:L/A:N and S:U directly refute an RCE classification. Real-world risk is further constrained by the requirement for Cribl integration to be in use, which narrows the exposed population to Kibana deployments using that specific data-pipeline integration. |
| Exploit ScenarioDerived | An attacker who has obtained or compromised a Kibana account with Fleet management privileges navigates to the Cribl integration configuration panel and injects a crafted expression into the insufficiently validated configuration field. When Kibana processes the configuration, the injected expression is evaluated server-side and an Elasticsearch ingest pipeline is created using server-side privileges that exceed what the attacker's API key would normally authorize, allowing unauthorized pipeline definitions to persist in the cluster. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Template injection in Kibana's Cribl integration allows a low-privileged authenticated user holding Fleet management rights to write Elasticsearch ingest pipelines exceeding their authorized Elasticsearch permissions. The flaw stems from insufficient validation of a configuration field that is rendered server-side as a script template, giving the attacker a code injection foothold (CWE-94) into the pipeline generation path. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L/I:L) reflects the constrained privilege requirement and limited integrity impact.
RemediationAI
Upgrade Kibana to a patched release as described in Elastic advisory ESA-2026-151 at https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159; the URL slug suggests fix versions in the 8.19.x and 9.4.x/9.5.x lines, though exact version numbers should be confirmed against the advisory directly. If immediate upgrade is not possible, restrict the Kibana Fleet management role to the minimum set of trusted operators, since exploitation requires that privilege; this does not eliminate the flaw but reduces the attack surface. Additionally, if the Cribl integration is not actively in use, disabling or unconfiguring it removes the vulnerable code path entirely - this is the most targeted compensating control with no impact on other Fleet functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kibana's Fleet management subsystem includes a Cribl integration that accepts user-supplied configuration fields rendered into server-side script templates. Those templates are processed to generate Elasticsearch ingest pipelines. Elasticsearch ingest pipelines define per-document transformation logic executed within the Elasticsearch cluster. The affected CPE is cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*, covering the broadly-deployed Kibana application. CWE-94 (Improper Control of Generation of Code) identifies the root cause: attacker-controlled data is interpolated into a code-generation context without sufficient sanitization, allowing expression injection. The resulting pipeline is written to Elasticsearch using server-side credentials rather than the caller's restricted API key, constituting an intra-cluster privilege boundary crossing.
Know when Kibana gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Matches vendor vector: network-reachable, low-privilege Fleet role required, no confidentiality or availability impact, integrity limited to unauthorized pipeline writes.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
DescriptionCVE.org
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Authorization bypass in Kibana's Fleet package installation process lets an authenticated user who holds delegated Fleet
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Exploit-DB