# Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-67)

**URL:** <https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569>\
**Category:** Security Announcements\
**Created:** [July 21, 2026, 10:06pm UTC](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569 "2026-07-21T22:06:14Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![cronosda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cronosda/32/147882_2.png) [@cronosda](https://discuss.elastic.co/u/cronosda)\
**Post date:** [July 21, 2026, 10:06pm UTC](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569/1 "2026-07-21T22:06:14Z")

</div>

**Missing Authorization in Kibana Leading to Unauthorized Information Disclosure**

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

**Affected Versions:**

- 9.x:
  - All versions from 9.3.0 up to and including 9.3.7
  - All versions from 9.4.0 up to and including 9.4.3

Users on the 9.5.x release line are not affected. The fix was incorporated into the initial 9.5.0 release prior to its publication, and 9.5.0 was never shipped with the vulnerable code path.

**Affected Configurations:**

- Kibana deployments running an Enterprise license with both the Agent Builder and Workflows Management features enabled. The Workflows Management feature is enabled by default in Enterprise deployments starting in Kibana 9.3. Deployments where users have been granted the agentBuilder:all Kibana feature privilege without the corresponding workflowsManagement:readExecution privilege are affected.

**Solutions and Mitigations:**

The issue is resolved in versions 9.3.8 and 9.4.4.

**For Users that Cannot Upgrade:**

- There are no workarounds for this vulnerability.

**Indicators of Compromise (IOC)**

No specific indicators of compromise have been identified for this vulnerability.

**Elastic Cloud Serverless**

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

**Severity:** CVSSv3.1: Medium ( 4.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N  
**CVE ID:** CVE-2026-63143  
**Problem Type:** CWE-862 - Missing Authorization  
**Impact:** CAPEC-122 - Privilege Abuse