Kibana vulnerabilities

Kibana versions prior to 5.2.1 configured for SSL client access do not clean up file descriptors after certain requests, leading to accumulation over time until the process crashes.

Kibana versions before 4.5.4 and 4.1.11, when a custom output is configured for logging, may write cookies and authorization headers to log files. This information could be used to hijack sessions of other users using Kibana behind some form of authentication such as Shield.

Incorrect authorization in Kibana can lead to disclosure of sensitive information. An authenticated user with limited Fleet privileges could access credential material restricted to Fleet administrators. Exploitation may allow theft of cryptographic keys and impersonation of trusted Fleet infrastructure components.

Missing authorization in Kibana's Metrics Experience feature allows a user with only data-store-level read access to retrieve index-derived metric data through Kibana, despite lacking the corresponding Kibana feature privilege. A related API enforced authorization, but this internal API did not.

Kibana contains an authorization bypass vulnerability in the Fleet package installation process. A user with delegated Fleet package-management privileges can claim a data stream identifier already in use by another tenant, redirecting the victim's data to infrastructure controlled by the attacker.

Uncontrolled resource consumption (CWE-400) in Kibana can lead to denial of service via excessive allocation (CAPEC-130).

Missing authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via exploiting incorrectly configured access control security levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.

A vulnerability in Kibana allows authorization bypass through a user-controlled key (CWE-639). An authenticated user with the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.

Incorrect Authorization in Kibana can lead to unauthorized configuration modification via exploiting incorrectly configured access control security levels.

Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.

Incorrect Authorization in Kibana can lead to privilege escalation via input data manipulation. Elasticsearch cluster privilege declarations from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents.

Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learning functionality beyond their authorization scope, consuming cluster resources they should not be able to reach.

Missing Authorization in Kibana for an Entity Store configuration operation allows an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices the user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

Path Traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of internal resources. A low-privileged user with Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface.

Incorrect Authorization in the Kibana machine learning feature can lead to information disclosure. An authenticated user with ML job management privileges in a single Kibana space could cause a job's saved object to become accessible across all spaces, without holding access rights to those additional spaces.

Path Traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of resources. A low-privileged user could cause a subsequent action by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in deletion of resources including accounts with elevated privileges.

A path traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of privileged resources. A low-privileged user with Fleet Settings write access could cause administrative actions to affect unintended internal resources, such as user accounts.

Unrestricted resource allocation in Kibana can lead to denial of service. An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users.

Observable response discrepancy in the Kibana Osquery feature can lead to information disclosure. An authenticated user with Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.

Missing authorization in Kibana Entity Store allows unauthorized credential creation. An authenticated low-privilege user can invoke an administrative operation that creates Elasticsearch API keys, bypassing required elevated privileges.

Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in Kibana can lead to unauthorized deletion of privileged resources. A low-privileged user with tag creation privileges could cause a subsequent administrative action to act on an unintended target, resulting in deletion of privileged resources including admin accounts. Exploitation requires administrator interaction.

A resource allocation vulnerability (CWE-770) in Kibana can lead to denial of service. An authenticated user with low, read-level Agent Builder privileges could submit a crafted request causing unbounded memory consumption and process termination.

A vulnerability in Kibana's machine learning feature involving execution with unnecessary privileges (CWE-250) can lead to information disclosure. An operation available to read-only users was performed with an internal service identity, allowing access to Elasticsearch indices the user is not authorized to read.

A vulnerability in Kibana allows an authenticated user to submit a specially crafted request that causes excessive resource consumption, potentially leading to a denial of service and making Kibana unavailable.

A vulnerability in Kibana allows a user with low privileges (access to Observability AI Assistant) to submit a specially crafted request that causes an unhandled error, terminating the Kibana process and denying service to all users until restart.

A vulnerability in Kibana allows an authenticated user with read-only access to Security Solution in a Kibana space to enumerate and change the state of Entity Store maintainer tasks, potentially disabling Entity Analytics maintenance for that space.

A vulnerability in Kibana Entity Analytics allows a user with read-only Security access and no Elasticsearch privileges to stop the recurring Privilege Monitoring engine task for a Kibana space, causing monitoring data to stop being produced while the engine still reports a healthy state.

A vulnerability in Kibana related to handling highly compressed data allows an authenticated user with Streams management privileges to supply specially crafted content that expands to a much larger volume during processing, exhausting Kibana's memory and causing the process to be terminated by the host.

A vulnerability in Kibana allows an authenticated user with access to the query functionality to perform NoSQL injection, altering the intended query logic and returning data the user is not authorized to read.

Incorrect authorization in Kibana can lead to privilege escalation. A user with workflow edit permissions could cause scheduled workflow executions to run with higher-privileged user's privileges, allowing unauthorized data access and modification.

A vulnerability in Kibana allows an authenticated user with low-level permissions to submit a specially crafted request that causes excessive resource consumption, potentially making Kibana unavailable.

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an authenticated user holding only the Agent Builder read privilege can supply an identifier already in use by another user in the same space and cause that user's conversation to be replaced and reassigned to the requesting account. The original owner permanently loses access to the conversation and its history. The impact is limited to loss of integrity and availability of the affected conversation; the attacker does not read the overwritten content.

Kibana contains a Relative Path Traversal (CWE-23) vulnerability that can lead to unauthorized deletion of Kibana resources. Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored and later incorporated into the request when that configuration is removed.

Kibana contains a Missing Authorization (CWE-862) vulnerability that can lead to cross-space information disclosure and unauthorized data modification. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep ML data separated. Part of the ML functionality did not apply that filter, so operations from one space were carried out against ML data of every space.

Kibana has a resource allocation vulnerability (CWE-770) leading to denial of service via excessive allocation. A user-supplied list of document fields in the Playground for RAG feature is not bounded or de-duplicated before building responses. A single crafted request can make Kibana build a response far larger than the source data, exhausting instance resources.

Kibana has an incorrect authorization vulnerability (CWE-863) allowing unauthorized deletion of Synthetics private locations. Locations can be shared across spaces, and the deletion safeguard only checks monitors visible in the user's own space. An authenticated user with Synthetics write privilege in one space can delete a location that other spaces depend on, even without access to those spaces.

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the requesting user's account. Only Kibana feature privileges are verified, not the caller's Elasticsearch index privileges. An authenticated user with Elastic Security feature privileges but no read access to Elastic Defend event indices can retrieve field values, including process command line arguments, which commonly contain tokens, credentials, and other sensitive operational detail.

A Kibana Machine Learning capability that removes a saved object from the current space accepts trained models as a target, but only verifies privileges for anomaly detection and data frame analytics jobs. A user with those job creation privileges but without trained model privilege can remove a trained model from a space. The model is not deleted and remains in other spaces, and the change can be reversed by a privileged user.

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings. The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user with only generic read access to the space can discover other users' onboarding flows, read their state, and write arbitrary progress data. A tampered flow can also cause the owner's onboarding view to fail with a server error.