CVE-2026-63138
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability in Kibana allows an authenticated user with access to the query functionality to perform NoSQL injection, altering the intended query logic and returning data the user is not authorized to read.
Risk Assessment
The attack can lead to disclosure of sensitive data that the user should not have access to.
Recommendation
Update Kibana to a patched version and restrict access to query functionality.
Other vulnerabilities in Kibana
See all- CVE-2017-8452High
Kibana versions prior to 5.2.1 configured for SSL client access do not clean up file descriptors after certain requests, leading to accumulation over time until the process crashes.
- CVE-2016-1000219High
Kibana versions before 4.5.4 and 4.1.11, when a custom output is configured for logging, may write cookies and authorization headers to log files. This information could be used to hijack sessions of other users using Kibana behind some form of authentication such as Shield.
- CVE-2019-7609CriticalActively exploited
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that attempts to execute JavaScript code, potentially leading to arbitrary command execution with the permissions of the Kibana process on the host system.
- CVE-2026-82302High
Incorrect Authorization in Kibana can lead to unauthorized configuration modification via exploiting incorrectly configured access control security levels.
- CVE-2026-82299Medium
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
- CVE-2026-82298Medium
Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
- CVE-2026-78596Medium
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.
- CVE-2026-78595Medium
Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.
- CVE-2026-78593Medium
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.
- CVE-2026-78583High
Incorrect Authorization in Kibana can lead to privilege escalation via input data manipulation. Elasticsearch cluster privilege declarations from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents.
Original NVD description (English source)
Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic, returning data the user is not authorized to read.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS