Executive brief
Kibana is a data visualization dashboard used to analyze information stored in Elasticsearch. A security vulnerability allows users with data-writing privileges to insert malicious code into the dashboard. If another user views this data, the malicious code could manipulate the interface or force the viewer's browser to make unauthorized network requests.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Kibana due to improper neutralization of input during web page generation (CWE-79). An attacker with write access to an Elasticsearch index can persist malicious HTML/markup. When a victim views the affected Kibana dashboard or view, the unsanitized markup is rendered in their browser session. This requires low privileges (PR:L) and user interaction (UI:R) from the victim. Successful exploitation allows for UI manipulation and the execution of outbound network requests in the context of the victim's session. The issue is fixed in Kibana versions 8.19.16 and 9.3.5.
Affected products
- Elastic Kibana 8.0.0 to 8.19.15, 9.0.0 to 9.3.4
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-05-28: patched: Fixed in 8.19.16 and 9.3.5