Kibana vulnerabilities

Kibana has an uncontrolled resource consumption vulnerability (CWE-400) leading to denial of service via excessive allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, backend services become unstable, causing service disruption and deployment unavailability for all users.

Kibana One Workflow has an SSRF vulnerability (CWE-918). An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.

In Kibana, an Incorrect Authorization vulnerability (CWE-863) can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint composes its response by fetching full configuration objects and returning them directly, bypassing the authorization checks enforced by the dedicated settings APIs.

Incorrect authorization in Kibana allows a user with Fleet management privileges in one space to retrieve Fleet Server policy details from other spaces via an internal enrollment endpoint that bypasses space-scoped access controls.