Out-of-bounds Write in Kibana Leading to Remote Code Execution
Out-of-bounds Write (CWE-787) in the Brotli decoder of Node.js, a dependency of Kibana (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to corrupt memory and potentially execute code in the Kibana server process via a specially crafted, malformed compressed response to an outbound request. Exploitation requires an attacker who controls the response from a destination that Kibana sends requests to, which triggers the known vulnerability CVE-2026-111497. Kibana bundles an affected version of the Node.js runtime. Elastic confirmed that the vulnerable decoder is reachable in Kibana but did not reproduce memory corruption or code execution in Kibana.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.23
- 9.x:
- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5
Affected Configurations:
- All Kibana deployments run the affected Node.js runtime. Exposure depends on outbound HTTP requests whose responses an attacker can control. Exposed paths can include connectors such as Webhook, Workflows HTTP requests, and Fleet package registry requests.
- An attacker must control the response from one of these destinations. This requires a privileged user who configures a new connector to an attacker-controlled host, a compromised upstream service with an existing connector, or network-level interception and modification of a connection that is not protected by TLS with full certificate verification.
- Brotli-compressed inbound request bodies sent to Kibana cannot directly trigger the issue.
Solutions and Mitigations:
The issue is resolved in version 8.19.24, 9.4.9, and 9.5.6. These versions bundle Node.js 24.22.1, which contains the upstream fix.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
These measures reduce exposure. They do not protect against a compromised upstream service that remains a permitted destination.
- Self-hosted: Restrict outbound connector destinations to the hosts you need with the xpack.actions.allowedHosts setting in kibana.yml. The default value permits all hosts.
- Self-hosted: Require HTTPS with full certificate and hostname verification for outbound connections. Keep xpack.actions.ssl.verificationMode at its default value of full, and do not lower verification for individual connectors or hosts.
- Disable or remove connectors, Workflows, and other outbound integrations that you do not use.
- Elastic Cloud Hosted: Apply the same connector settings through the Kibana user settings of your deployment.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: High ( 8.1 ) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID: CVE-2026-111497
Problem Type: CWE-787 - Out-of-bounds Write