Kibana
Monthly
NoSQL injection in Kibana exposes unauthorized Elasticsearch data to authenticated low-privilege users who can submit crafted query input. The flaw, classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic / CAPEC-676), allows manipulation of backend NoSQL query logic to return records outside the user's authorized data scope. Elastic has released fixed versions 9.4.5 and 9.5.1 per ESA-2026-168; no public exploit or CISA KEV listing has been identified at time of analysis.
Kibana's Entity Store feature permits a low-privilege authenticated Security user to invoke an administrative initialization operation that creates and persists Elasticsearch API keys without holding the elevated cluster and Kibana privileges the documented setup flow mandates. The root cause is CWE-862 Missing Authorization - the endpoint does not verify the caller meets the required permission tier before executing the privileged action. Elastic has released fixes in versions 8.19.21 and 9.4.6 per ESA-2026-155; no public exploit has been identified at time of analysis.
Second-order path traversal in Kibana allows a low-privileged user with tag creation rights to cause an administrator's routine tag management action to operate on an unintended privileged resource, resulting in permanent deletion of administrator accounts or other organizational assets. Affected versions span the Elastic Stack deployment across the 8.x and 9.x series, with patches released in Kibana 8.19.16, 9.3.5, and 9.4.2. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog, but the potential to delete administrative accounts elevates this beyond a typical medium-severity finding in multi-tenant deployments.
Incorrect Authorization in Kibana's Elastic AI Assistant Knowledge Base allows an authenticated user to read, modify, and delete private Knowledge Base entries belonging to a different user when both principals share an identical username value but originate from distinct authentication realms. Elastic advisory ESA-2026-142 confirms the flaw across multiple 8.x and 9.x release lines, with fixed versions 8.19.21, 9.4.6, and 9.5.2 released. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; exploitation is gated by a high-complexity prerequisite - a username collision across separately configured authentication realms - which significantly limits the exposed population.
Kibana's missing server-side authorization check (CWE-862) allows any authenticated user holding only minimal Elasticsearch privileges to bypass Kibana feature authorization and Space access controls, reading Fleet deployment metadata from the default Kibana space without having been granted that permission. The flaw is rooted in an absent authorization gate on Fleet API paths rather than a misconfiguration, meaning the control is simply not enforced rather than configured incorrectly. Elastic has self-reported the issue and released fixes in versions 9.4.6 and 9.5.1 per advisory ESA-2026-149; no public exploit code or active exploitation (CISA KEV) has been identified.
Missing authorization on an internal Kibana APM integration function exposes APM server credentials to any authenticated Kibana user. The affected endpoint was designed for APM or Fleet administrators but lacked the corresponding role-based access control check, allowing lower-privileged authenticated users to retrieve secrets that govern access to the APM backend. No public exploit code or CISA KEV listing exists at time of analysis; however, the straightforward exploitation path and high confidentiality impact from credential exposure make this a meaningful lateral-movement risk in Elastic Stack deployments.
Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified.
Incorrect Authorization (CWE-863) in Kibana's Entity Analytics module allows an authenticated low-privilege user to silently halt the Privilege Monitoring engine for an entire Kibana space. A user holding only read-level Security feature access - and no Elasticsearch privileges - can invoke the task-stop action, causing privileged user activity tracking to cease while the engine continues to falsely report a healthy operational state to administrators. No public exploit has been identified at time of analysis, but the deceptive healthy-status behavior creates a detection blind spot directly useful for insider threat operations or post-compromise privilege escalation concealment. Fixed in Kibana 9.4.6 and 9.5.2 per Elastic advisory ESA-2026-130.
Incorrect authorization in Kibana's Security Solution allows a low-privileged authenticated user to exceed their read-only role by enumerating and modifying Entity Store maintainer task states, silently disabling Entity Analytics upkeep for the affected space. The affected user requires only Security Solution read access-no write or admin privileges-yet can manipulate internal scheduling tasks that keep entity data current for threat detection. No public exploit has been identified and this is not in CISA KEV; the CVSS 5.4 (Medium) score reflects real-world scope: no data confidentiality impact, but integrity and availability of analytics maintenance are undermined.
Denial of service in Kibana allows an authenticated user holding Streams management privileges to crash the Kibana process by submitting specially crafted compressed content that expands to a disproportionately large volume during server-side processing, exhausting available memory. The host OS terminates the Kibana process, and the service remains unavailable to all users until manually restarted. The advisory ESA-2026-125 identifies fixed versions as 8.19.21, 9.4.6, and 9.5.2; no public exploit or KEV listing has been identified at time of analysis.
Uncaught exception handling in Kibana's Observability AI Assistant allows any low-privileged authenticated user to crash the entire Kibana Node.js process by submitting a specially crafted request, denying service to all users and spaces on that instance until an administrator manually restarts it. The blast radius is instance-wide regardless of the attacker's permission scope, making this disproportionately severe relative to its CVSS 6.5 Medium rating. Elastic confirmed the fix in versions 9.4.5 and 9.5.1 via advisory ESA-2026-115; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unbounded memory allocation in Kibana's Agent Builder feature allows any authenticated user with minimal read-level privileges to crash the Kibana process, denying service to all users of the affected instance. The vulnerability stems from CWE-770 (no resource throttling), meaning a single low-privileged user can trigger full process termination via one crafted request. Elastic has addressed this in Kibana 9.4.6 via security advisory ESA-2026-84; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Kibana allows an authenticated user holding workflow edit permissions to cause scheduled workflow executions to run under the privileges of a higher-privileged user, granting unauthorized read and write access to data outside their authorization scope. The flaw (CWE-863, Incorrect Authorization) stems from Kibana's workflow scheduling subsystem failing to enforce authorization boundaries when executing scheduled jobs - a pattern classified under CAPEC-180. No public exploit exists at time of analysis, but the CVSS 8.3 (High) score with a network-accessible, low-privilege attack vector reflects genuine impact for any multi-user Kibana deployment. Elastic's advisory ESA-2026-61 references Kibana 9.4.3 as the fix release.
Unthrottled resource allocation in Kibana allows an authenticated network user to submit a specially crafted request that drives excessive server-side resource consumption, potentially rendering the Kibana dashboard fully unavailable. Reported by Elastic and addressed in ESA-2026-48, the vulnerability is classified under CWE-770 and maps to the CAPEC-130 excessive allocation attack pattern. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the fix is confirmed in Kibana 8.19.19 and 9.3.5.
Denial of service in Elastic Kibana allows any authenticated low-privilege user to render the analytics interface unavailable by submitting specially crafted requests that trigger unbounded resource consumption (CWE-770, CAPEC-130). All Kibana versions prior to 8.19.17 and 9.3.0 are affected. No public exploit or CISA KEV listing exists at time of analysis; the risk is real but limited to authenticated accounts.
Denial of service in Kibana's Cases module allows any authenticated user with case comment privileges to permanently render a specific case inaccessible to all users by posting a comment containing malformed link syntax. The comment rendering pipeline fails to sanitize or reject the invalid input, triggering an uncaught exception (CWE-248) that prevents the case from loading for every subsequent viewer until the offending comment is manually deleted. No public exploit has been identified at time of analysis, and no CISA KEV listing is present; the CVSS score of 4.3 (Medium) reflects the limited blast radius - individual cases rather than the Kibana instance as a whole are affected.
Elasticsearch API key leakage in Kibana Fleet exposes enrolled agent credentials to any low-privileged authenticated user through a filter-based side channel. Fleet's agent listing endpoint accepts caller-supplied filter expressions evaluated under Kibana's own elevated internal Elasticsearch privileges rather than the caller's, and the match count in each response functions as a boolean oracle, enabling character-by-character reconstruction of the full API key value across all Kibana versions prior to 8.19.20, 9.4.5, and 9.5.1. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the CVSS 7.1 (C:H) rating reflects the severity of full credential exfiltration via an authenticated, network-reachable, low-complexity attack.
Privilege escalation in Kibana Fleet allows authenticated low-privileged users to expand the write scope of Elasticsearch API keys issued to Elastic Agents beyond intended boundaries. By declaring extra data streams in an integration policy, an attacker causes Fleet to over-provision the API key given to enrolled agents, granting write-insert and index-mapping-extension privileges on indices outside the legitimate scope of that integration. No public exploit has been identified at time of analysis, and the flaw has not been listed in the CISA KEV catalog, but the network-accessible attack vector and low privilege requirement make this a meaningful integrity risk in multi-tenant or shared Elastic Stack deployments.
Privilege escalation in Kibana Fleet allows an authenticated low-privileged user to bypass integration-scoped authorization controls by exploiting a logic flaw in how policy update requests are validated (CWE-863). An operator holding only the Elastic Defend endpoint policy management role can craft a Fleet API update request that substitutes a different integration type into an existing endpoint policy they control, because Fleet evaluates the authorization check against the stored policy's original integration rather than the replacement integration supplied in the request. No public exploit code has been identified at time of analysis, but the vendor (Elastic) has issued advisory ESA-2026-127 with patched releases.
Cross-space authorization bypass in Kibana allows authenticated users to access trained machine learning model inference outputs, and stop or modify active model deployments, in Kibana Spaces they are not authorized to access. The vulnerability arises because API endpoints for ML model inference and deployment management accept user-controlled resource identifiers without enforcing space-level ACL boundaries, enabling privilege escalation across the Space isolation boundary. No public exploit code has been identified and Elastic has released fixed versions 8.19.20, 9.4.5, and 9.5.1 per advisory ESA-2026-126.
Incorrect authorization in Kibana Agent Builder allows authenticated users to access, modify, or delete private agents they do not own when sharing a username with another principal across different Elasticsearch authentication realms. The flaw stems from a fallback ownership check that compares usernames - which are not unique across realms - rather than stable user identifiers, enabling cross-realm identity confusion. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network accessibility make this a credible insider or multi-tenant threat.
Elastic Security's case management API in Kibana fails to enforce the same authorization controls applied in the UI, allowing authenticated low-privileged users to modify case records they are only entitled to view. The vulnerability arises from a mass-assignment flaw (CWE-915/CAPEC-77) where the API accepts object attributes that bypass privilege checks enforced at the UI layer - a classic server-side trust boundary mismatch. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low exploitation complexity (AV:N/AC:L/PR:L) makes it accessible to any authenticated insider or compromised low-privilege account.
Resource exhaustion in Elastic Kibana allows an authenticated user who holds maintenance window management privileges to crash the Kibana process for all users by submitting a specially crafted malformed payload. The Kibana process consumes unbounded resources and becomes fully unresponsive, requiring manual operator intervention to restore service - there is no automatic recovery. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low access complexity and broad multi-tenant availability impact make it a meaningful operational risk for shared Kibana deployments.
Denial of service in Elastic Kibana's alerting feature allows an authenticated user with read-only alerting privileges to crash the Kibana process for all users by submitting a single crafted malformed payload. The resource exhaustion is unbounded - a single HTTP request is sufficient to render Kibana unable to serve any users until the process is manually restarted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and broad impact make it a meaningful risk in any multi-tenant Kibana deployment where alerting access is granted to partially-trusted users.
Cross-space alerting rule telemetry disclosure in Kibana allows an authenticated user with read access to alerting rules in one Kibana space to retrieve execution telemetry belonging to other spaces they are not authorized to access. The exposed metadata includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters - a meaningful control gap for organizations using Kibana Spaces for multi-tenant or departmental isolation. Fixes are available in Kibana 8.19.20 and 9.4.5 per Elastic advisory ESA-2026-105; no public exploit or CISA KEV listing exists at time of analysis.
Algorithmic complexity exhaustion in Kibana's TSVB (Time Series Visual Builder) expression evaluator allows any authenticated user to render the entire Kibana instance unresponsive with a single crafted request. The synchronous evaluation of a specially crafted deeply nested expression monopolizes the Kibana request-processing thread indefinitely, blocking all subsequent requests until the service is manually restarted. Patched versions 8.19.20 and 9.4.5 are available per Elastic advisory ESA-2026-104; no public exploit or CISA KEV listing has been identified at time of analysis.
Missing authorization in Kibana's internal data retrieval capability for Elastic Defend endpoint response actions exposes sensitive security telemetry to any authenticated low-privileged user. The internal API endpoint used for endpoint response actions bypasses the Security Solution and endpoint privilege checks applied to its user-facing equivalents, executing with elevated internal permissions rather than the requesting user's permissions. No public exploit or CISA KEV listing exists at time of analysis; however, any authenticated Kibana user - regardless of Security Solution role assignments - can exploit this to read endpoint response records and host-returned response content from managed endpoints.
Denial of service in Kibana allows an authenticated low-privileged user to crash the entire Kibana process by submitting specially crafted input data. The crafted payload triggers an uncaught exception (CWE-248) on a critical execution path, causing Kibana to terminate and become unavailable to all users until manually restarted. Because the condition is repeatable, an attacker holding only basic credentials can maintain a persistent denial-of-service state. No public exploit has been identified at time of analysis, and no KEV listing exists.
Denial of service in Elastic Kibana allows any authenticated low-privileged user to crash the entire Kibana service for all users by submitting a specially crafted, malformed payload to a visualization feature. The root cause is CWE-770 (resource allocation without throttling): Kibana fails to validate the malformed input before processing, causing unbounded heap growth until the host OS kills the process. No public exploit has been identified at time of analysis, and exploitation requires authenticated access, but the low privilege bar and total service disruption make this a meaningful insider or compromised-credential threat. Patch versions 8.19.20 and 9.4.5 are referenced in the vendor advisory ESA-2026-100.
Privilege escalation in Kibana arises from insufficient CSRF protection in the Vega visualization engine, affecting all versions prior to 8.19.20 and 9.4.5. Any Kibana user with visualization creation rights can embed a specially crafted Vega specification that, when rendered by a higher-privileged user's browser, silently issues authenticated HTTP requests to Kibana under the victim's session credentials. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though the low attack complexity and widely deployed nature of the product make this a meaningful remediation priority.
Unbounded resource allocation in Kibana's Observability log analysis validation feature enables any authenticated low-privilege user to exhaust the Kibana process memory and deny service to all users. The flaw (CWE-770, CAPEC-130) requires only minimal credentials - no elevated roles - and a single inexpensive HTTP request triggers concurrent work without throttling. Notably, the request can be repeated trivially, sustaining pressure even on well-provisioned deployments that might otherwise degrade gracefully rather than crash outright. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, though the low exploitation bar makes this a credible insider or credential-abuse threat.
Unauthorized Osquery live query execution in Elastic Kibana allows a low-privileged authenticated user to run endpoint queries against Elastic Agents assigned to Kibana spaces they have no authorization to access, violating the platform's space-based multi-tenancy access control model. By exploiting a user-controlled key authorization bypass (CWE-639 / CAPEC-1), an attacker can exfiltrate host telemetry - running processes, network connections, file system state - from isolated organizational spaces, with results written to the Osquery results data stream accessible to the attacker. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at the time of analysis; however, the network-accessible vector and high confidentiality impact make this a meaningful risk in multi-tenant deployments.
Missing Authorization in Kibana's Elastic Security module permits authenticated users holding detection rule authoring privileges to execute Osquery live queries and Elastic Defend response actions against enrolled managed endpoints without possessing the specific Osquery or Elastic Defend privileges that normally govern those capabilities. The CVSS 8.1 score reflects a network-accessible, low-complexity attack path with high confidentiality and integrity impact against enrolled host infrastructure. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but patch versions 8.19.20 and 9.4.5 are available per Elastic Security Advisory ESA-2026-96.
Missing authorization in Elastic Kibana's Security solution allows users holding only detection rule authoring privileges to associate and indirectly trigger Elastic Defend endpoint response actions - including host isolation, process termination, and remote execution - against managed hosts, without ever being granted the dedicated Endpoint response action privileges that are supposed to govern those capabilities. The exploitation path is indirect: a restricted user crafts a detection rule with embedded response actions, and when that rule generates alerts against matching endpoints, the privileged actions execute autonomously through the Elastic Defend agent. No public exploit has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Relative path traversal in Kibana's Fleet component allows an authenticated low-privileged user to delete arbitrary Kibana resources by supplying a crafted Fleet Server host configuration identifier containing traversal sequences. Elastic has confirmed the flaw in ESA-2026-94 and released patched versions 8.19.17, 9.3.6, and 9.4.3. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Kibana's Machine Learning subsystem fails to enforce space-level authorization, allowing any authenticated low-privilege user in one Kibana space to read ML data from all other spaces and make unauthorized modifications across the entire deployment. The root cause is that ML operations execute with elevated internal Elasticsearch permissions while a subset of ML functionality omitted the per-request space isolation filter that enforces tenancy boundaries. No public exploit has been identified, but the attack requires only a standard user account, making it a realistic internal threat in multi-tenant or shared Kibana deployments. Fixed versions 8.19.20 and 9.4.5 are referenced in the Elastic security advisory ESA-2026-92.
Denial of service in Kibana's Playground for RAG feature allows a low-privileged authenticated user to exhaust the memory and processing resources of a Kibana instance via a single crafted request. The vulnerable endpoint accepts a user-supplied list of document fields without enforcing any length bound or deduplication, enabling a request to trigger construction of a response orders of magnitude larger than the underlying data. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis. Elastic has released fixes in versions 9.3.8 and 9.4.4.
Incorrect authorization in Kibana's Synthetics feature allows an authenticated user holding only Synthetics write privilege in a single space to permanently delete private locations shared across multiple spaces, including those the user has no access to. The root cause is an incomplete access-control check that evaluates only the monitors visible in the requesting user's own space, ignoring dependent monitors in other spaces. No public exploit or active exploitation has been identified; the CVSS 5.4 score reflects a real but bounded integrity and availability impact limited to Elastic Kibana instances using multi-space Synthetics deployments.
Elastic Kibana's Elastic Security endpoint policy editor exposes sensitive Elastic Defend telemetry through a privilege escalation in the field value suggestion feature. Authenticated users holding Kibana Elastic Security feature privileges - but lacking Elasticsearch index-level read access to Elastic Defend event indices - can retrieve field values including process command line arguments, which routinely contain credentials, API tokens, and connection strings harvested from protected endpoints. No public exploit has been identified at time of analysis, but the low attack complexity and scope change across the Kibana-to-Elasticsearch authorization boundary make this straightforward to abuse by any user with a qualifying Kibana role.
Kibana's Machine Learning space management feature performs an incomplete authorization check when removing a saved object from a space, accepting trained models as targets while only verifying privileges for anomaly detection jobs and data frame analytics jobs. Authenticated users whose roles grant ML job creation rights but lack the trained model privilege can therefore remove a trained model from the active space, despite having no legitimate authority over trained models. No public exploit is identified and this vulnerability is not listed in CISA KEV; real-world impact is bounded by the reversibility of the action and the non-deletion of the underlying model.
Broken object-level authorization in Elastic Kibana's Fleet module exposes sensitive proxy configuration data to under-privileged users who should not have access to it. A user holding only the 'read agent policies' permission - a scope far narrower than Fleet administrative access - can read the full Fleet proxy configuration, including proxy authentication credentials and private key material. No public exploit code has been identified at time of analysis, but the CVSS Scope Changed metric (S:C) reflects that stolen credentials could be leveraged against proxy infrastructure well beyond the Kibana instance itself.
Missing authorization on Kibana's Observability Onboarding API routes allows any authenticated low-privilege user sharing a Kibana space to enumerate, read, and overwrite the onboarding flow state of other users in that space. Affected installations include all Kibana versions prior to 8.19.19 and 9.4.5 across both self-managed and Elastic Cloud deployments. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS high integrity impact (I:H) reflects an attacker's ability to corrupt another user's onboarding progress and trigger persistent server errors in the victim's Observability Onboarding view.
Kibana's Agent Builder feature bypasses cross-feature authorization, allowing any authenticated low-privilege user to create and execute agent tools that invoke Kibana features requiring higher privileges than the user possesses. Affected by CWE-862 (Missing Authorization), this flaw effectively nullifies role-based access controls for features reachable via Agent Builder tooling, enabling unauthorized read access to sensitive data. No public exploit or active exploitation has been identified; Elastic has issued a fix in Kibana 9.4.4 via advisory ESA-2026-83.
Kibana's Agent Builder feature exposes an A2A JSON-RPC API endpoint vulnerable to Insecure Direct Object Reference (CWE-639), allowing an authenticated low-privilege user to overwrite and seize ownership of another user's conversation within the same Kibana space. The root cause is that the server-side ownership check treats a non-existent conversation ID identically to one that exists but belongs to a different user, so supplying a known identifier is sufficient to hijack it. No confidentiality breach occurs - the attacker does not read overwritten content - but the original owner suffers permanent, irrecoverable loss of their conversation history. No public exploit code has been identified and this CVE does not appear in CISA KEV at time of analysis.
Denial-of-service in Kibana's connector reporting endpoint allows any authenticated user - including those with read-only privileges - to permanently incapacitate the Kibana process with a single crafted request. The flaw stems from accepting arbitrarily large query expressions without size limits, causing the process to consume unbounded CPU evaluating the expression and rendering the instance unable to serve any user until manually restarted. No public exploit has been identified, but the low privilege bar (read-only access) and single-request reproducibility make this an attractive target for internal threat actors or compromised low-privilege accounts seeking to disrupt SOC or observability operations.
Cross-space information disclosure in Kibana 9.4.0 through 9.4.3 allows authenticated users to access data from Kibana Spaces they are not authorized to view. The flaw (CWE-862, Missing Authorization) arises because user-supplied input can reference cross-space resources without adequate space-level authorization checks, enabling privilege boundary bypass within a multi-tenant Kibana deployment. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Uncontrolled memory allocation in Kibana's machine learning feature allows low-privileged authenticated users to exhaust server memory, causing a complete denial of service for all users. Three major version lines are affected - 8.x through 8.19.18, 9.0.x through 9.3.7, and 9.4.x through 9.4.3 - with vendor-released patches available across all three. No active exploitation confirmed via CISA KEV and no public exploit code identified at time of analysis, but the low authentication barrier (any valid account) makes this a meaningful internal threat in shared Kibana environments.
Denial of service in Elastic Kibana allows any authenticated low-privilege user to crash the Kibana process by sending a specially crafted oversized HTTP request payload, exhausting Node.js heap memory and making the analytics platform unavailable to all users. Affected branches span Kibana 8.x (through 8.19.18), 9.0.x-9.3.x (through 9.3.7), and 9.4.x (through 9.4.3), with patched releases available per ESA-2026-71. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Kibana's multi-tenancy Spaces model can be bypassed through an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to read scheduled query results belonging to Spaces they are not authorized to access. Affected versions span Kibana 9.4.0 through 9.4.3, with the fix delivered in 9.4.4. The CVSS vector (PR:L, C:L) confirms the impact is limited to low-privilege authenticated access resulting in partial confidentiality loss - no integrity or availability impact is involved. No public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Incorrect Authorization in Kibana's Machine Learning management endpoint allows a low-privileged authenticated user to manipulate ML audit and notification records for arbitrary jobs across any space or user boundary. The endpoint validates only a coarse ML access privilege without enforcing resource-level authorization, and then uses Kibana's internally elevated credentials to write to restricted ML system indices on behalf of the requesting user. No public exploit has been identified at time of analysis, and CVSS scores this at Medium (4.3) given the limited integrity-only impact scope.
Unauthorized access to workflow execution outputs in Kibana 9.3.0-9.3.7 and 9.4.0-9.4.3 allows an authenticated low-privileged user to read sensitive data returned by workflow steps - including results from connected data sources they are not authorized to query - by directly calling the workflow output endpoint without the authorization the documented API requires. The flaw is classified as Missing Authorization (CWE-862) via Privilege Abuse (CAPEC-122), with impact limited to confidentiality within the user's accessible Kibana space. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Elastic has released patched versions 9.3.8 and 9.4.4.
Outbound request restriction bypass in Kibana's Reporting feature enables authenticated low-privileged attackers to cause the reporting service to issue HTTP requests to network destinations explicitly denied by administrator-configured security policy. Affected versions span Kibana 8.x through 8.19.18, 9.0.x through 9.3.7, and 9.4.x through 9.4.3. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Kibana itself to internal network resources, making this a server-side request forgery (SSRF)-class issue. No public exploit code or CISA KEV listing identified at time of analysis.
Missing authorization controls in Kibana's Cloud Connect endpoints allow any authenticated low-privilege user to read and modify Cloud Connect configuration and service settings that should be restricted to users with specific feature privileges. Exploitation occurs via direct HTTP requests to insufficiently protected internal API endpoints, bypassing Kibana's privilege enforcement layer entirely. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low barrier - requiring only a valid Kibana account - elevates practical risk in multi-tenant or externally accessible deployments.
Kibana's Canvas functionality allows any authenticated low-privileged user to crash the Kibana server process via a specially crafted request, causing a complete denial of service for all users of the affected instance. The root cause is uncontrolled resource consumption (CWE-400 / CAPEC-130), where Canvas fails to bound server-side resource allocation when processing attacker-controlled input. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity once authenticated makes independent rediscovery plausible.
Unauthorized information disclosure and case-attachment tampering in Elastic Kibana lets a low-privileged authenticated user with limited file-management permissions read, alter, or delete case attachments belonging to feature areas they should not reach, including sensitive Security Solution cases. The flaw stems from Kibana's file-access authorization check and its resource retrieval using two different resolution mechanisms, allowing the authorization gate to be bypassed. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS was not provided.
Incorrect Authorization (CWE-863) in Kibana's Entity Analytics Watchlist feature allows low-privileged authenticated users with read-only Security Solution access to perform unauthorized write operations against watchlist configuration endpoints that should require elevated privileges. The CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable but credential-gated exploitation with limited confidentiality and integrity impact; under specific deployment conditions, affected users may additionally access data outside their authorized scope. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Denial of service in Kibana's Entity Analytics feature allows authenticated users to render the application unavailable by submitting oversized input values to affected API endpoints. The root cause is CWE-770 - absent resource allocation limits on specific Entity Analytics endpoints - enabling a single crafted request to trigger excessive memory or CPU consumption disproportionate to normal operation. No public exploit code has been identified at time of analysis, and the PR:L authentication requirement constrains opportunistic exploitation to credentialed actors.
Kibana's authorization layer fails to enforce ACLs correctly in certain code paths, allowing a lower-privileged authenticated user to cause data from restricted Elasticsearch sources to be processed under another user's elevated privileges - effectively a confused deputy attack resulting in unauthorized information disclosure. The CVSS 4.3 (Medium) rating reflects low confidentiality impact and the requirement for a valid Kibana account, but the real-world risk is material in multi-tenant or role-segregated deployments where data isolation is a compliance requirement. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Log injection in Elastic Kibana (fixed in 7.17.15 and 8.11.1) allows an attacker with low-privilege access to embed unneutralized control characters in input that Kibana writes verbatim to its log files; when an operator later views those logs in a terminal that interprets ANSI/control sequences, the injected payload can forge, hide, or rewrite displayed log content. The issue is tracked as CWE-117 (Improper Output Neutralization for Logs) and carries a vendor CVSS of 8.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Fleet policy management in Kibana is vulnerable to denial of service through insufficient validation of user-supplied policy inputs. An authenticated Kibana user with Fleet write access can submit a specially crafted Fleet policy input that bypasses server-side validation, rendering Fleet agent management, server operations, and policy configuration unavailable. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the low authentication bar (any valid low-privilege account) and network accessibility make it a meaningful operational risk for organizations relying on Elastic Agent deployments.
Sensitive HTTP request header values are written into Kibana application logs when the optional APM (Application Performance Monitoring) instrumentation feature is enabled, exposing credentials or tokens to anyone with operator-level log access. This affects multiple Kibana release branches (8.18.x, 8.19.x, 9.0.x, and 9.1.x) and is classified as information disclosure under CWE-532. No public exploit or active exploitation has been identified at time of analysis; the exposure is passive and gated behind both a non-default configuration and existing operator privileges.
Denial of service in Kibana allows any authenticated user with low-privilege access to exhaust server resources via a specially crafted bulk deletion request, potentially rendering the Kibana interface completely unavailable. Affected are Kibana deployments prior to versions 8.19.15 and 9.3.4 across both the 8.x and 9.x release branches. The vulnerability requires no special configuration to be present and no user interaction beyond submitting the malicious request, making it reliably triggerable by any valid Kibana account holder. No public exploit or CISA KEV listing identified at time of analysis.
Server-Side Request Forgery in Elastic Kibana 9.3.0 through 9.3.2 lets an authenticated user holding connector management privileges override the operator-configured connector allowlist and force the Kibana server to make outbound requests to destinations that egress controls were meant to block. Because the request originates from the trusted server, an attacker can reach internal or otherwise restricted network services and exfiltrate their responses. EPSS is very low (0.03%, 9th percentile) and there is no public exploit identified at time of analysis, but the scope-changing CVSS 7.7 rating reflects meaningful confidentiality impact against internal assets.
Denial of service in Kibana's analytics collections management endpoint allows any authenticated user with viewer-level access to render the service completely unavailable. By submitting a request containing an oversized input value, the attacker causes Kibana to consume excessive CPU and memory, crashing the service for all users and requiring manual intervention to restore. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low privilege bar - viewer access only - significantly elevates real-world risk in multi-tenant or SaaS Elastic deployments.
Privilege escalation in Elastic Kibana's Fleet agent policy management feature allows authenticated Fleet administrators to inject unvalidated values into a configuration override mechanism, causing Elastic Agents to be provisioned with API keys carrying elevated Elasticsearch privileges. Successful exploitation yields unauthorized read/write access to sensitive Elasticsearch security indices beyond the Fleet role's intended scope. No public exploit identified at time of analysis, and CISA KEV does not list this issue.
Server-Side Request Forgery in Kibana One Workflow allows authenticated users with workflow privileges to bypass host allowlist restrictions in the Workflows Execution Engine, enabling unauthorized access to sensitive internal endpoints and data disclosure. Affects Kibana versions 9.3.0 through 9.3.2. No public exploit code or active exploitation has been confirmed at time of analysis.
Denial of service in Kibana's automatic import feature allows authenticated users to trigger uncontrolled resource consumption by submitting specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, backend services become unstable, resulting in service disruption across all users. CVSS 6.5 (medium severity) reflects the authenticated attack requirement and high availability impact without confidentiality or integrity compromise.
Kibana's Fleet agent management endpoint fails to enforce space-scoped access controls, allowing authenticated users with Fleet privileges in one space to retrieve sensitive Fleet Server policy details from unauthorized spaces including policy names, operational identifiers, and infrastructure linkage information. The vulnerability affects Kibana across multiple versions and requires valid user authentication with Fleet agent management permissions, resulting in cross-space information disclosure without the ability to modify data.
Authorization bypass in Elastic Kibana allows authenticated users with limited Fleet privileges to retrieve sensitive configuration data including private keys and authentication tokens through an internal API endpoint. The vulnerability affects network-accessible instances and bypasses intended privilege boundaries by returning full configuration objects without proper authorization checks. CVSS score of 7.7 reflects high confidentiality impact with scope change. No public exploit identified at time of analysis, though the attack vector is straightforward for authenticated users.
Authenticated Kibana users with Fleet management privileges can read Elasticsearch index data beyond their intended RBAC permissions through debug route handlers in the Fleet plugin. This scope bypass affects Elastic Kibana deployments where users hold Fleet sub-feature privileges (agent policies, settings management). The vulnerability requires low-privilege authentication (PR:L) and has network attack vector (AV:N) with low complexity (AC:L), enabling cross-scope data confidentiality breach (S:C/C:H). No public exploit identified at time of analysis. EPSS data not available, but the specific privilege escalation vector and remote exploitability warrant prioritization in Kibana Fleet deployments.
Kibana versions up to 9.3.0 contains a vulnerability that allows attackers to read arbitrary files from the Kibana server filesystem, and perform Server-Side (CVSS 8.6).
Kibana's Timelion component is vulnerable to denial of service through uncontrolled resource consumption when processing malicious input data, affecting authenticated users with network access to the application. An attacker with valid credentials can manipulate input to exhaust system resources and render the service unavailable. No patch is currently available for this vulnerability.
Kibana's AI Inference Anonymization Engine contains a ReDoS (Regular Expression Denial of Service) vulnerability that allows authenticated high-privilege users to crash the service through maliciously crafted input. An attacker with administrative credentials can trigger exponential regex backtracking to render the system unavailable, though no patch is currently available.
Kibana's Content Connectors search endpoint fails to properly validate user input, allowing authenticated attackers to trigger a denial of service condition through crafted request data. This medium-severity vulnerability affects systems where users have login credentials and can be exploited without user interaction.
Kibana contains a vulnerability that allows attackers to an authenticated attacker with view-only privileges to cause a Denial of Service (CVSS 6.5).
Kibana's Email Connector fails to properly validate email address parameters, allowing authenticated users with view-level privileges to trigger excessive resource allocation and crash the service. An attacker can exploit this input validation flaw by submitting a specially crafted email address to cause complete denial of service, requiring manual service restart to restore availability for all users. No patch is currently available.
Kibana Fleet is vulnerable to denial of service through uncontrolled resource allocation when processing specially crafted bulk retrieval requests, allowing authenticated users with viewer-level privileges to exhaust server memory and crash the application. An attacker can trigger redundant database operations that consume resources without limits, rendering the service unavailable to all users. No patch is currently available for this vulnerability.
Kibana Fleet fails to limit resource allocation when processing specially crafted requests, allowing authenticated attackers to trigger excessive CPU and memory consumption that degrades or completely disables the service. The vulnerability affects Kibana deployments where users have authentication access, and no patch is currently available to remediate the issue.
Denial of Service in Prometheus and Kibana metricsets can be triggered by sending specially crafted malformed payloads to Graphite, Zookeeper, or Prometheus data sources due to improper array index validation and input validation flaws. An unauthenticated attacker on the network can exploit this to crash monitoring services without user interaction. No patch is currently available.
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.
CVE-2024-43706 is an improper authorization vulnerability in Kibana's Synthetic monitor endpoint that allows authenticated users to escalate privileges through direct HTTP requests. Attackers with low-level credentials can bypass access controls to perform unauthorized actions on synthetic monitoring functionality, potentially affecting confidentiality, integrity, and availability. While the CVSS 7.6 score indicates significant risk, real-world impact depends on deployment context and whether this vulnerability is actively exploited in the wild.
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
NoSQL injection in Kibana exposes unauthorized Elasticsearch data to authenticated low-privilege users who can submit crafted query input. The flaw, classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic / CAPEC-676), allows manipulation of backend NoSQL query logic to return records outside the user's authorized data scope. Elastic has released fixed versions 9.4.5 and 9.5.1 per ESA-2026-168; no public exploit or CISA KEV listing has been identified at time of analysis.
Kibana's Entity Store feature permits a low-privilege authenticated Security user to invoke an administrative initialization operation that creates and persists Elasticsearch API keys without holding the elevated cluster and Kibana privileges the documented setup flow mandates. The root cause is CWE-862 Missing Authorization - the endpoint does not verify the caller meets the required permission tier before executing the privileged action. Elastic has released fixes in versions 8.19.21 and 9.4.6 per ESA-2026-155; no public exploit has been identified at time of analysis.
Second-order path traversal in Kibana allows a low-privileged user with tag creation rights to cause an administrator's routine tag management action to operate on an unintended privileged resource, resulting in permanent deletion of administrator accounts or other organizational assets. Affected versions span the Elastic Stack deployment across the 8.x and 9.x series, with patches released in Kibana 8.19.16, 9.3.5, and 9.4.2. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog, but the potential to delete administrative accounts elevates this beyond a typical medium-severity finding in multi-tenant deployments.
Incorrect Authorization in Kibana's Elastic AI Assistant Knowledge Base allows an authenticated user to read, modify, and delete private Knowledge Base entries belonging to a different user when both principals share an identical username value but originate from distinct authentication realms. Elastic advisory ESA-2026-142 confirms the flaw across multiple 8.x and 9.x release lines, with fixed versions 8.19.21, 9.4.6, and 9.5.2 released. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; exploitation is gated by a high-complexity prerequisite - a username collision across separately configured authentication realms - which significantly limits the exposed population.
Kibana's missing server-side authorization check (CWE-862) allows any authenticated user holding only minimal Elasticsearch privileges to bypass Kibana feature authorization and Space access controls, reading Fleet deployment metadata from the default Kibana space without having been granted that permission. The flaw is rooted in an absent authorization gate on Fleet API paths rather than a misconfiguration, meaning the control is simply not enforced rather than configured incorrectly. Elastic has self-reported the issue and released fixes in versions 9.4.6 and 9.5.1 per advisory ESA-2026-149; no public exploit code or active exploitation (CISA KEV) has been identified.
Missing authorization on an internal Kibana APM integration function exposes APM server credentials to any authenticated Kibana user. The affected endpoint was designed for APM or Fleet administrators but lacked the corresponding role-based access control check, allowing lower-privileged authenticated users to retrieve secrets that govern access to the APM backend. No public exploit code or CISA KEV listing exists at time of analysis; however, the straightforward exploitation path and high confidentiality impact from credential exposure make this a meaningful lateral-movement risk in Elastic Stack deployments.
Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified.
Incorrect Authorization (CWE-863) in Kibana's Entity Analytics module allows an authenticated low-privilege user to silently halt the Privilege Monitoring engine for an entire Kibana space. A user holding only read-level Security feature access - and no Elasticsearch privileges - can invoke the task-stop action, causing privileged user activity tracking to cease while the engine continues to falsely report a healthy operational state to administrators. No public exploit has been identified at time of analysis, but the deceptive healthy-status behavior creates a detection blind spot directly useful for insider threat operations or post-compromise privilege escalation concealment. Fixed in Kibana 9.4.6 and 9.5.2 per Elastic advisory ESA-2026-130.
Incorrect authorization in Kibana's Security Solution allows a low-privileged authenticated user to exceed their read-only role by enumerating and modifying Entity Store maintainer task states, silently disabling Entity Analytics upkeep for the affected space. The affected user requires only Security Solution read access-no write or admin privileges-yet can manipulate internal scheduling tasks that keep entity data current for threat detection. No public exploit has been identified and this is not in CISA KEV; the CVSS 5.4 (Medium) score reflects real-world scope: no data confidentiality impact, but integrity and availability of analytics maintenance are undermined.
Denial of service in Kibana allows an authenticated user holding Streams management privileges to crash the Kibana process by submitting specially crafted compressed content that expands to a disproportionately large volume during server-side processing, exhausting available memory. The host OS terminates the Kibana process, and the service remains unavailable to all users until manually restarted. The advisory ESA-2026-125 identifies fixed versions as 8.19.21, 9.4.6, and 9.5.2; no public exploit or KEV listing has been identified at time of analysis.
Uncaught exception handling in Kibana's Observability AI Assistant allows any low-privileged authenticated user to crash the entire Kibana Node.js process by submitting a specially crafted request, denying service to all users and spaces on that instance until an administrator manually restarts it. The blast radius is instance-wide regardless of the attacker's permission scope, making this disproportionately severe relative to its CVSS 6.5 Medium rating. Elastic confirmed the fix in versions 9.4.5 and 9.5.1 via advisory ESA-2026-115; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unbounded memory allocation in Kibana's Agent Builder feature allows any authenticated user with minimal read-level privileges to crash the Kibana process, denying service to all users of the affected instance. The vulnerability stems from CWE-770 (no resource throttling), meaning a single low-privileged user can trigger full process termination via one crafted request. Elastic has addressed this in Kibana 9.4.6 via security advisory ESA-2026-84; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Kibana allows an authenticated user holding workflow edit permissions to cause scheduled workflow executions to run under the privileges of a higher-privileged user, granting unauthorized read and write access to data outside their authorization scope. The flaw (CWE-863, Incorrect Authorization) stems from Kibana's workflow scheduling subsystem failing to enforce authorization boundaries when executing scheduled jobs - a pattern classified under CAPEC-180. No public exploit exists at time of analysis, but the CVSS 8.3 (High) score with a network-accessible, low-privilege attack vector reflects genuine impact for any multi-user Kibana deployment. Elastic's advisory ESA-2026-61 references Kibana 9.4.3 as the fix release.
Unthrottled resource allocation in Kibana allows an authenticated network user to submit a specially crafted request that drives excessive server-side resource consumption, potentially rendering the Kibana dashboard fully unavailable. Reported by Elastic and addressed in ESA-2026-48, the vulnerability is classified under CWE-770 and maps to the CAPEC-130 excessive allocation attack pattern. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the fix is confirmed in Kibana 8.19.19 and 9.3.5.
Denial of service in Elastic Kibana allows any authenticated low-privilege user to render the analytics interface unavailable by submitting specially crafted requests that trigger unbounded resource consumption (CWE-770, CAPEC-130). All Kibana versions prior to 8.19.17 and 9.3.0 are affected. No public exploit or CISA KEV listing exists at time of analysis; the risk is real but limited to authenticated accounts.
Denial of service in Kibana's Cases module allows any authenticated user with case comment privileges to permanently render a specific case inaccessible to all users by posting a comment containing malformed link syntax. The comment rendering pipeline fails to sanitize or reject the invalid input, triggering an uncaught exception (CWE-248) that prevents the case from loading for every subsequent viewer until the offending comment is manually deleted. No public exploit has been identified at time of analysis, and no CISA KEV listing is present; the CVSS score of 4.3 (Medium) reflects the limited blast radius - individual cases rather than the Kibana instance as a whole are affected.
Elasticsearch API key leakage in Kibana Fleet exposes enrolled agent credentials to any low-privileged authenticated user through a filter-based side channel. Fleet's agent listing endpoint accepts caller-supplied filter expressions evaluated under Kibana's own elevated internal Elasticsearch privileges rather than the caller's, and the match count in each response functions as a boolean oracle, enabling character-by-character reconstruction of the full API key value across all Kibana versions prior to 8.19.20, 9.4.5, and 9.5.1. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the CVSS 7.1 (C:H) rating reflects the severity of full credential exfiltration via an authenticated, network-reachable, low-complexity attack.
Privilege escalation in Kibana Fleet allows authenticated low-privileged users to expand the write scope of Elasticsearch API keys issued to Elastic Agents beyond intended boundaries. By declaring extra data streams in an integration policy, an attacker causes Fleet to over-provision the API key given to enrolled agents, granting write-insert and index-mapping-extension privileges on indices outside the legitimate scope of that integration. No public exploit has been identified at time of analysis, and the flaw has not been listed in the CISA KEV catalog, but the network-accessible attack vector and low privilege requirement make this a meaningful integrity risk in multi-tenant or shared Elastic Stack deployments.
Privilege escalation in Kibana Fleet allows an authenticated low-privileged user to bypass integration-scoped authorization controls by exploiting a logic flaw in how policy update requests are validated (CWE-863). An operator holding only the Elastic Defend endpoint policy management role can craft a Fleet API update request that substitutes a different integration type into an existing endpoint policy they control, because Fleet evaluates the authorization check against the stored policy's original integration rather than the replacement integration supplied in the request. No public exploit code has been identified at time of analysis, but the vendor (Elastic) has issued advisory ESA-2026-127 with patched releases.
Cross-space authorization bypass in Kibana allows authenticated users to access trained machine learning model inference outputs, and stop or modify active model deployments, in Kibana Spaces they are not authorized to access. The vulnerability arises because API endpoints for ML model inference and deployment management accept user-controlled resource identifiers without enforcing space-level ACL boundaries, enabling privilege escalation across the Space isolation boundary. No public exploit code has been identified and Elastic has released fixed versions 8.19.20, 9.4.5, and 9.5.1 per advisory ESA-2026-126.
Incorrect authorization in Kibana Agent Builder allows authenticated users to access, modify, or delete private agents they do not own when sharing a username with another principal across different Elasticsearch authentication realms. The flaw stems from a fallback ownership check that compares usernames - which are not unique across realms - rather than stable user identifiers, enabling cross-realm identity confusion. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network accessibility make this a credible insider or multi-tenant threat.
Elastic Security's case management API in Kibana fails to enforce the same authorization controls applied in the UI, allowing authenticated low-privileged users to modify case records they are only entitled to view. The vulnerability arises from a mass-assignment flaw (CWE-915/CAPEC-77) where the API accepts object attributes that bypass privilege checks enforced at the UI layer - a classic server-side trust boundary mismatch. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low exploitation complexity (AV:N/AC:L/PR:L) makes it accessible to any authenticated insider or compromised low-privilege account.
Resource exhaustion in Elastic Kibana allows an authenticated user who holds maintenance window management privileges to crash the Kibana process for all users by submitting a specially crafted malformed payload. The Kibana process consumes unbounded resources and becomes fully unresponsive, requiring manual operator intervention to restore service - there is no automatic recovery. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low access complexity and broad multi-tenant availability impact make it a meaningful operational risk for shared Kibana deployments.
Denial of service in Elastic Kibana's alerting feature allows an authenticated user with read-only alerting privileges to crash the Kibana process for all users by submitting a single crafted malformed payload. The resource exhaustion is unbounded - a single HTTP request is sufficient to render Kibana unable to serve any users until the process is manually restarted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and broad impact make it a meaningful risk in any multi-tenant Kibana deployment where alerting access is granted to partially-trusted users.
Cross-space alerting rule telemetry disclosure in Kibana allows an authenticated user with read access to alerting rules in one Kibana space to retrieve execution telemetry belonging to other spaces they are not authorized to access. The exposed metadata includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters - a meaningful control gap for organizations using Kibana Spaces for multi-tenant or departmental isolation. Fixes are available in Kibana 8.19.20 and 9.4.5 per Elastic advisory ESA-2026-105; no public exploit or CISA KEV listing exists at time of analysis.
Algorithmic complexity exhaustion in Kibana's TSVB (Time Series Visual Builder) expression evaluator allows any authenticated user to render the entire Kibana instance unresponsive with a single crafted request. The synchronous evaluation of a specially crafted deeply nested expression monopolizes the Kibana request-processing thread indefinitely, blocking all subsequent requests until the service is manually restarted. Patched versions 8.19.20 and 9.4.5 are available per Elastic advisory ESA-2026-104; no public exploit or CISA KEV listing has been identified at time of analysis.
Missing authorization in Kibana's internal data retrieval capability for Elastic Defend endpoint response actions exposes sensitive security telemetry to any authenticated low-privileged user. The internal API endpoint used for endpoint response actions bypasses the Security Solution and endpoint privilege checks applied to its user-facing equivalents, executing with elevated internal permissions rather than the requesting user's permissions. No public exploit or CISA KEV listing exists at time of analysis; however, any authenticated Kibana user - regardless of Security Solution role assignments - can exploit this to read endpoint response records and host-returned response content from managed endpoints.
Denial of service in Kibana allows an authenticated low-privileged user to crash the entire Kibana process by submitting specially crafted input data. The crafted payload triggers an uncaught exception (CWE-248) on a critical execution path, causing Kibana to terminate and become unavailable to all users until manually restarted. Because the condition is repeatable, an attacker holding only basic credentials can maintain a persistent denial-of-service state. No public exploit has been identified at time of analysis, and no KEV listing exists.
Denial of service in Elastic Kibana allows any authenticated low-privileged user to crash the entire Kibana service for all users by submitting a specially crafted, malformed payload to a visualization feature. The root cause is CWE-770 (resource allocation without throttling): Kibana fails to validate the malformed input before processing, causing unbounded heap growth until the host OS kills the process. No public exploit has been identified at time of analysis, and exploitation requires authenticated access, but the low privilege bar and total service disruption make this a meaningful insider or compromised-credential threat. Patch versions 8.19.20 and 9.4.5 are referenced in the vendor advisory ESA-2026-100.
Privilege escalation in Kibana arises from insufficient CSRF protection in the Vega visualization engine, affecting all versions prior to 8.19.20 and 9.4.5. Any Kibana user with visualization creation rights can embed a specially crafted Vega specification that, when rendered by a higher-privileged user's browser, silently issues authenticated HTTP requests to Kibana under the victim's session credentials. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though the low attack complexity and widely deployed nature of the product make this a meaningful remediation priority.
Unbounded resource allocation in Kibana's Observability log analysis validation feature enables any authenticated low-privilege user to exhaust the Kibana process memory and deny service to all users. The flaw (CWE-770, CAPEC-130) requires only minimal credentials - no elevated roles - and a single inexpensive HTTP request triggers concurrent work without throttling. Notably, the request can be repeated trivially, sustaining pressure even on well-provisioned deployments that might otherwise degrade gracefully rather than crash outright. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, though the low exploitation bar makes this a credible insider or credential-abuse threat.
Unauthorized Osquery live query execution in Elastic Kibana allows a low-privileged authenticated user to run endpoint queries against Elastic Agents assigned to Kibana spaces they have no authorization to access, violating the platform's space-based multi-tenancy access control model. By exploiting a user-controlled key authorization bypass (CWE-639 / CAPEC-1), an attacker can exfiltrate host telemetry - running processes, network connections, file system state - from isolated organizational spaces, with results written to the Osquery results data stream accessible to the attacker. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at the time of analysis; however, the network-accessible vector and high confidentiality impact make this a meaningful risk in multi-tenant deployments.
Missing Authorization in Kibana's Elastic Security module permits authenticated users holding detection rule authoring privileges to execute Osquery live queries and Elastic Defend response actions against enrolled managed endpoints without possessing the specific Osquery or Elastic Defend privileges that normally govern those capabilities. The CVSS 8.1 score reflects a network-accessible, low-complexity attack path with high confidentiality and integrity impact against enrolled host infrastructure. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but patch versions 8.19.20 and 9.4.5 are available per Elastic Security Advisory ESA-2026-96.
Missing authorization in Elastic Kibana's Security solution allows users holding only detection rule authoring privileges to associate and indirectly trigger Elastic Defend endpoint response actions - including host isolation, process termination, and remote execution - against managed hosts, without ever being granted the dedicated Endpoint response action privileges that are supposed to govern those capabilities. The exploitation path is indirect: a restricted user crafts a detection rule with embedded response actions, and when that rule generates alerts against matching endpoints, the privileged actions execute autonomously through the Elastic Defend agent. No public exploit has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Relative path traversal in Kibana's Fleet component allows an authenticated low-privileged user to delete arbitrary Kibana resources by supplying a crafted Fleet Server host configuration identifier containing traversal sequences. Elastic has confirmed the flaw in ESA-2026-94 and released patched versions 8.19.17, 9.3.6, and 9.4.3. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Kibana's Machine Learning subsystem fails to enforce space-level authorization, allowing any authenticated low-privilege user in one Kibana space to read ML data from all other spaces and make unauthorized modifications across the entire deployment. The root cause is that ML operations execute with elevated internal Elasticsearch permissions while a subset of ML functionality omitted the per-request space isolation filter that enforces tenancy boundaries. No public exploit has been identified, but the attack requires only a standard user account, making it a realistic internal threat in multi-tenant or shared Kibana deployments. Fixed versions 8.19.20 and 9.4.5 are referenced in the Elastic security advisory ESA-2026-92.
Denial of service in Kibana's Playground for RAG feature allows a low-privileged authenticated user to exhaust the memory and processing resources of a Kibana instance via a single crafted request. The vulnerable endpoint accepts a user-supplied list of document fields without enforcing any length bound or deduplication, enabling a request to trigger construction of a response orders of magnitude larger than the underlying data. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis. Elastic has released fixes in versions 9.3.8 and 9.4.4.
Incorrect authorization in Kibana's Synthetics feature allows an authenticated user holding only Synthetics write privilege in a single space to permanently delete private locations shared across multiple spaces, including those the user has no access to. The root cause is an incomplete access-control check that evaluates only the monitors visible in the requesting user's own space, ignoring dependent monitors in other spaces. No public exploit or active exploitation has been identified; the CVSS 5.4 score reflects a real but bounded integrity and availability impact limited to Elastic Kibana instances using multi-space Synthetics deployments.
Elastic Kibana's Elastic Security endpoint policy editor exposes sensitive Elastic Defend telemetry through a privilege escalation in the field value suggestion feature. Authenticated users holding Kibana Elastic Security feature privileges - but lacking Elasticsearch index-level read access to Elastic Defend event indices - can retrieve field values including process command line arguments, which routinely contain credentials, API tokens, and connection strings harvested from protected endpoints. No public exploit has been identified at time of analysis, but the low attack complexity and scope change across the Kibana-to-Elasticsearch authorization boundary make this straightforward to abuse by any user with a qualifying Kibana role.
Kibana's Machine Learning space management feature performs an incomplete authorization check when removing a saved object from a space, accepting trained models as targets while only verifying privileges for anomaly detection jobs and data frame analytics jobs. Authenticated users whose roles grant ML job creation rights but lack the trained model privilege can therefore remove a trained model from the active space, despite having no legitimate authority over trained models. No public exploit is identified and this vulnerability is not listed in CISA KEV; real-world impact is bounded by the reversibility of the action and the non-deletion of the underlying model.
Broken object-level authorization in Elastic Kibana's Fleet module exposes sensitive proxy configuration data to under-privileged users who should not have access to it. A user holding only the 'read agent policies' permission - a scope far narrower than Fleet administrative access - can read the full Fleet proxy configuration, including proxy authentication credentials and private key material. No public exploit code has been identified at time of analysis, but the CVSS Scope Changed metric (S:C) reflects that stolen credentials could be leveraged against proxy infrastructure well beyond the Kibana instance itself.
Missing authorization on Kibana's Observability Onboarding API routes allows any authenticated low-privilege user sharing a Kibana space to enumerate, read, and overwrite the onboarding flow state of other users in that space. Affected installations include all Kibana versions prior to 8.19.19 and 9.4.5 across both self-managed and Elastic Cloud deployments. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS high integrity impact (I:H) reflects an attacker's ability to corrupt another user's onboarding progress and trigger persistent server errors in the victim's Observability Onboarding view.
Kibana's Agent Builder feature bypasses cross-feature authorization, allowing any authenticated low-privilege user to create and execute agent tools that invoke Kibana features requiring higher privileges than the user possesses. Affected by CWE-862 (Missing Authorization), this flaw effectively nullifies role-based access controls for features reachable via Agent Builder tooling, enabling unauthorized read access to sensitive data. No public exploit or active exploitation has been identified; Elastic has issued a fix in Kibana 9.4.4 via advisory ESA-2026-83.
Kibana's Agent Builder feature exposes an A2A JSON-RPC API endpoint vulnerable to Insecure Direct Object Reference (CWE-639), allowing an authenticated low-privilege user to overwrite and seize ownership of another user's conversation within the same Kibana space. The root cause is that the server-side ownership check treats a non-existent conversation ID identically to one that exists but belongs to a different user, so supplying a known identifier is sufficient to hijack it. No confidentiality breach occurs - the attacker does not read overwritten content - but the original owner suffers permanent, irrecoverable loss of their conversation history. No public exploit code has been identified and this CVE does not appear in CISA KEV at time of analysis.
Denial-of-service in Kibana's connector reporting endpoint allows any authenticated user - including those with read-only privileges - to permanently incapacitate the Kibana process with a single crafted request. The flaw stems from accepting arbitrarily large query expressions without size limits, causing the process to consume unbounded CPU evaluating the expression and rendering the instance unable to serve any user until manually restarted. No public exploit has been identified, but the low privilege bar (read-only access) and single-request reproducibility make this an attractive target for internal threat actors or compromised low-privilege accounts seeking to disrupt SOC or observability operations.
Cross-space information disclosure in Kibana 9.4.0 through 9.4.3 allows authenticated users to access data from Kibana Spaces they are not authorized to view. The flaw (CWE-862, Missing Authorization) arises because user-supplied input can reference cross-space resources without adequate space-level authorization checks, enabling privilege boundary bypass within a multi-tenant Kibana deployment. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Uncontrolled memory allocation in Kibana's machine learning feature allows low-privileged authenticated users to exhaust server memory, causing a complete denial of service for all users. Three major version lines are affected - 8.x through 8.19.18, 9.0.x through 9.3.7, and 9.4.x through 9.4.3 - with vendor-released patches available across all three. No active exploitation confirmed via CISA KEV and no public exploit code identified at time of analysis, but the low authentication barrier (any valid account) makes this a meaningful internal threat in shared Kibana environments.
Denial of service in Elastic Kibana allows any authenticated low-privilege user to crash the Kibana process by sending a specially crafted oversized HTTP request payload, exhausting Node.js heap memory and making the analytics platform unavailable to all users. Affected branches span Kibana 8.x (through 8.19.18), 9.0.x-9.3.x (through 9.3.7), and 9.4.x (through 9.4.3), with patched releases available per ESA-2026-71. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Kibana's multi-tenancy Spaces model can be bypassed through an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to read scheduled query results belonging to Spaces they are not authorized to access. Affected versions span Kibana 9.4.0 through 9.4.3, with the fix delivered in 9.4.4. The CVSS vector (PR:L, C:L) confirms the impact is limited to low-privilege authenticated access resulting in partial confidentiality loss - no integrity or availability impact is involved. No public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Incorrect Authorization in Kibana's Machine Learning management endpoint allows a low-privileged authenticated user to manipulate ML audit and notification records for arbitrary jobs across any space or user boundary. The endpoint validates only a coarse ML access privilege without enforcing resource-level authorization, and then uses Kibana's internally elevated credentials to write to restricted ML system indices on behalf of the requesting user. No public exploit has been identified at time of analysis, and CVSS scores this at Medium (4.3) given the limited integrity-only impact scope.
Unauthorized access to workflow execution outputs in Kibana 9.3.0-9.3.7 and 9.4.0-9.4.3 allows an authenticated low-privileged user to read sensitive data returned by workflow steps - including results from connected data sources they are not authorized to query - by directly calling the workflow output endpoint without the authorization the documented API requires. The flaw is classified as Missing Authorization (CWE-862) via Privilege Abuse (CAPEC-122), with impact limited to confidentiality within the user's accessible Kibana space. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Elastic has released patched versions 9.3.8 and 9.4.4.
Outbound request restriction bypass in Kibana's Reporting feature enables authenticated low-privileged attackers to cause the reporting service to issue HTTP requests to network destinations explicitly denied by administrator-configured security policy. Affected versions span Kibana 8.x through 8.19.18, 9.0.x through 9.3.7, and 9.4.x through 9.4.3. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Kibana itself to internal network resources, making this a server-side request forgery (SSRF)-class issue. No public exploit code or CISA KEV listing identified at time of analysis.
Missing authorization controls in Kibana's Cloud Connect endpoints allow any authenticated low-privilege user to read and modify Cloud Connect configuration and service settings that should be restricted to users with specific feature privileges. Exploitation occurs via direct HTTP requests to insufficiently protected internal API endpoints, bypassing Kibana's privilege enforcement layer entirely. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low barrier - requiring only a valid Kibana account - elevates practical risk in multi-tenant or externally accessible deployments.
Kibana's Canvas functionality allows any authenticated low-privileged user to crash the Kibana server process via a specially crafted request, causing a complete denial of service for all users of the affected instance. The root cause is uncontrolled resource consumption (CWE-400 / CAPEC-130), where Canvas fails to bound server-side resource allocation when processing attacker-controlled input. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity once authenticated makes independent rediscovery plausible.
Unauthorized information disclosure and case-attachment tampering in Elastic Kibana lets a low-privileged authenticated user with limited file-management permissions read, alter, or delete case attachments belonging to feature areas they should not reach, including sensitive Security Solution cases. The flaw stems from Kibana's file-access authorization check and its resource retrieval using two different resolution mechanisms, allowing the authorization gate to be bypassed. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS was not provided.
Incorrect Authorization (CWE-863) in Kibana's Entity Analytics Watchlist feature allows low-privileged authenticated users with read-only Security Solution access to perform unauthorized write operations against watchlist configuration endpoints that should require elevated privileges. The CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable but credential-gated exploitation with limited confidentiality and integrity impact; under specific deployment conditions, affected users may additionally access data outside their authorized scope. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Denial of service in Kibana's Entity Analytics feature allows authenticated users to render the application unavailable by submitting oversized input values to affected API endpoints. The root cause is CWE-770 - absent resource allocation limits on specific Entity Analytics endpoints - enabling a single crafted request to trigger excessive memory or CPU consumption disproportionate to normal operation. No public exploit code has been identified at time of analysis, and the PR:L authentication requirement constrains opportunistic exploitation to credentialed actors.
Kibana's authorization layer fails to enforce ACLs correctly in certain code paths, allowing a lower-privileged authenticated user to cause data from restricted Elasticsearch sources to be processed under another user's elevated privileges - effectively a confused deputy attack resulting in unauthorized information disclosure. The CVSS 4.3 (Medium) rating reflects low confidentiality impact and the requirement for a valid Kibana account, but the real-world risk is material in multi-tenant or role-segregated deployments where data isolation is a compliance requirement. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Log injection in Elastic Kibana (fixed in 7.17.15 and 8.11.1) allows an attacker with low-privilege access to embed unneutralized control characters in input that Kibana writes verbatim to its log files; when an operator later views those logs in a terminal that interprets ANSI/control sequences, the injected payload can forge, hide, or rewrite displayed log content. The issue is tracked as CWE-117 (Improper Output Neutralization for Logs) and carries a vendor CVSS of 8.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Fleet policy management in Kibana is vulnerable to denial of service through insufficient validation of user-supplied policy inputs. An authenticated Kibana user with Fleet write access can submit a specially crafted Fleet policy input that bypasses server-side validation, rendering Fleet agent management, server operations, and policy configuration unavailable. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the low authentication bar (any valid low-privilege account) and network accessibility make it a meaningful operational risk for organizations relying on Elastic Agent deployments.
Sensitive HTTP request header values are written into Kibana application logs when the optional APM (Application Performance Monitoring) instrumentation feature is enabled, exposing credentials or tokens to anyone with operator-level log access. This affects multiple Kibana release branches (8.18.x, 8.19.x, 9.0.x, and 9.1.x) and is classified as information disclosure under CWE-532. No public exploit or active exploitation has been identified at time of analysis; the exposure is passive and gated behind both a non-default configuration and existing operator privileges.
Denial of service in Kibana allows any authenticated user with low-privilege access to exhaust server resources via a specially crafted bulk deletion request, potentially rendering the Kibana interface completely unavailable. Affected are Kibana deployments prior to versions 8.19.15 and 9.3.4 across both the 8.x and 9.x release branches. The vulnerability requires no special configuration to be present and no user interaction beyond submitting the malicious request, making it reliably triggerable by any valid Kibana account holder. No public exploit or CISA KEV listing identified at time of analysis.
Server-Side Request Forgery in Elastic Kibana 9.3.0 through 9.3.2 lets an authenticated user holding connector management privileges override the operator-configured connector allowlist and force the Kibana server to make outbound requests to destinations that egress controls were meant to block. Because the request originates from the trusted server, an attacker can reach internal or otherwise restricted network services and exfiltrate their responses. EPSS is very low (0.03%, 9th percentile) and there is no public exploit identified at time of analysis, but the scope-changing CVSS 7.7 rating reflects meaningful confidentiality impact against internal assets.
Denial of service in Kibana's analytics collections management endpoint allows any authenticated user with viewer-level access to render the service completely unavailable. By submitting a request containing an oversized input value, the attacker causes Kibana to consume excessive CPU and memory, crashing the service for all users and requiring manual intervention to restore. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low privilege bar - viewer access only - significantly elevates real-world risk in multi-tenant or SaaS Elastic deployments.
Privilege escalation in Elastic Kibana's Fleet agent policy management feature allows authenticated Fleet administrators to inject unvalidated values into a configuration override mechanism, causing Elastic Agents to be provisioned with API keys carrying elevated Elasticsearch privileges. Successful exploitation yields unauthorized read/write access to sensitive Elasticsearch security indices beyond the Fleet role's intended scope. No public exploit identified at time of analysis, and CISA KEV does not list this issue.
Server-Side Request Forgery in Kibana One Workflow allows authenticated users with workflow privileges to bypass host allowlist restrictions in the Workflows Execution Engine, enabling unauthorized access to sensitive internal endpoints and data disclosure. Affects Kibana versions 9.3.0 through 9.3.2. No public exploit code or active exploitation has been confirmed at time of analysis.
Denial of service in Kibana's automatic import feature allows authenticated users to trigger uncontrolled resource consumption by submitting specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, backend services become unstable, resulting in service disruption across all users. CVSS 6.5 (medium severity) reflects the authenticated attack requirement and high availability impact without confidentiality or integrity compromise.
Kibana's Fleet agent management endpoint fails to enforce space-scoped access controls, allowing authenticated users with Fleet privileges in one space to retrieve sensitive Fleet Server policy details from unauthorized spaces including policy names, operational identifiers, and infrastructure linkage information. The vulnerability affects Kibana across multiple versions and requires valid user authentication with Fleet agent management permissions, resulting in cross-space information disclosure without the ability to modify data.
Authorization bypass in Elastic Kibana allows authenticated users with limited Fleet privileges to retrieve sensitive configuration data including private keys and authentication tokens through an internal API endpoint. The vulnerability affects network-accessible instances and bypasses intended privilege boundaries by returning full configuration objects without proper authorization checks. CVSS score of 7.7 reflects high confidentiality impact with scope change. No public exploit identified at time of analysis, though the attack vector is straightforward for authenticated users.
Authenticated Kibana users with Fleet management privileges can read Elasticsearch index data beyond their intended RBAC permissions through debug route handlers in the Fleet plugin. This scope bypass affects Elastic Kibana deployments where users hold Fleet sub-feature privileges (agent policies, settings management). The vulnerability requires low-privilege authentication (PR:L) and has network attack vector (AV:N) with low complexity (AC:L), enabling cross-scope data confidentiality breach (S:C/C:H). No public exploit identified at time of analysis. EPSS data not available, but the specific privilege escalation vector and remote exploitability warrant prioritization in Kibana Fleet deployments.
Kibana versions up to 9.3.0 contains a vulnerability that allows attackers to read arbitrary files from the Kibana server filesystem, and perform Server-Side (CVSS 8.6).
Kibana's Timelion component is vulnerable to denial of service through uncontrolled resource consumption when processing malicious input data, affecting authenticated users with network access to the application. An attacker with valid credentials can manipulate input to exhaust system resources and render the service unavailable. No patch is currently available for this vulnerability.
Kibana's AI Inference Anonymization Engine contains a ReDoS (Regular Expression Denial of Service) vulnerability that allows authenticated high-privilege users to crash the service through maliciously crafted input. An attacker with administrative credentials can trigger exponential regex backtracking to render the system unavailable, though no patch is currently available.
Kibana's Content Connectors search endpoint fails to properly validate user input, allowing authenticated attackers to trigger a denial of service condition through crafted request data. This medium-severity vulnerability affects systems where users have login credentials and can be exploited without user interaction.
Kibana contains a vulnerability that allows attackers to an authenticated attacker with view-only privileges to cause a Denial of Service (CVSS 6.5).
Kibana's Email Connector fails to properly validate email address parameters, allowing authenticated users with view-level privileges to trigger excessive resource allocation and crash the service. An attacker can exploit this input validation flaw by submitting a specially crafted email address to cause complete denial of service, requiring manual service restart to restore availability for all users. No patch is currently available.
Kibana Fleet is vulnerable to denial of service through uncontrolled resource allocation when processing specially crafted bulk retrieval requests, allowing authenticated users with viewer-level privileges to exhaust server memory and crash the application. An attacker can trigger redundant database operations that consume resources without limits, rendering the service unavailable to all users. No patch is currently available for this vulnerability.
Kibana Fleet fails to limit resource allocation when processing specially crafted requests, allowing authenticated attackers to trigger excessive CPU and memory consumption that degrades or completely disables the service. The vulnerability affects Kibana deployments where users have authentication access, and no patch is currently available to remediate the issue.
Denial of Service in Prometheus and Kibana metricsets can be triggered by sending specially crafted malformed payloads to Graphite, Zookeeper, or Prometheus data sources due to improper array index validation and input validation flaws. An unauthenticated attacker on the network can exploit this to crash monitoring services without user interaction. No patch is currently available.
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.
CVE-2024-43706 is an improper authorization vulnerability in Kibana's Synthetic monitor endpoint that allows authenticated users to escalate privileges through direct HTTP requests. Attackers with low-level credentials can bypass access controls to perform unauthorized actions on synthetic monitoring functionality, potentially affecting confidentiality, integrity, and availability. While the CVSS 7.6 score indicates significant risk, real-world impact depends on deployment context and whether this vulnerability is actively exploited in the wild.
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.