Executive brief
Kibana is a popular analytics and visualization platform used to search and analyze data stored in Elasticsearch. A vulnerability in Kibana's query management feature allows authenticated users to craft malicious inputs that bypass authorization controls and expose data they should not have access to. This could enable unauthorized staff or compromised accounts to view sensitive business intelligence or customer information.
Technical details
Kibana contains an improper neutralization of special elements (CWE-943) in its data query logic, leading to NoSQL injection (CAPEC-676). The vulnerability exists in a query management capability introduced in version 9.4.0. An authenticated user with access to the affected query interfaces can submit specially crafted input that alters the intended query logic, bypassing the application's authorization checks and returning unauthorized data. The vulnerability requires network access and valid credentials but no user interaction. Patches are available in Kibana 9.4.5 and 9.5.1; the 8.x release line is not affected as the vulnerable functionality does not exist there.
Affected products
- Elastic Kibana 9.4.0 through 9.4.4, 9.5.0
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixes released in Kibana 9.4.5 and 9.5.1