Executive brief
Kibana is a data visualization and analytics platform used to explore and analyze log and event data. An attacker with permissions to create visualizations can craft a malicious Vega visualization that, when opened by another Kibana user, silently performs unauthorized actions in that user's session. This could allow an attacker to escalate privileges, modify dashboards, or extract sensitive data from the viewing user's account.
Technical details
This vulnerability is a Cross-Site Request Forgery (CSRF/CWE-352) in Kibana's Vega visualization handling. An authenticated user with visualization creation permissions can craft a specially crafted Vega visualization object and save it. When another authenticated user opens this visualization, the malicious payload triggers authenticated HTTP requests to Kibana in the context of the viewing user's session, bypassing CSRF protections. The attack requires an authenticated attacker and user interaction (opening the visualization), but results in high impact—allowing privilege escalation and unauthorized state-changing operations. Patches are available in Kibana 8.19.20 and 9.4.5. As a workaround, administrators can disable the Vega visualization type via configuration.
Affected products
- Elastic Kibana 8.19.0–8.19.19, 9.0.0–9.4.4
Timeline
- 2026-08-13: disclosed
- 2026-08-13: patched: Patches released in Kibana 8.19.20 and 9.4.5