Missing Authorization in Kibana Leading to Unauthorized Information Disclosure
Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.
Affected Versions:
- 9.x:
- All versions from 9.3.0 up to and including 9.3.7
- All versions from 9.4.0 up to and including 9.4.3
Users on the 9.5.x release line are not affected. The fix was incorporated into the initial 9.5.0 release prior to its publication, and 9.5.0 was never shipped with the vulnerable code path.
Affected Configurations:
- Kibana deployments running an Enterprise license with both the Agent Builder and Workflows Management features enabled. The Workflows Management feature is enabled by default in Enterprise deployments starting in Kibana 9.3. Deployments where users have been granted the agentBuilder:all Kibana feature privilege without the corresponding workflowsManagement:readExecution privilege are affected.
Solutions and Mitigations:
The issue is resolved in versions 9.3.8 and 9.4.4.
For Users that Cannot Upgrade:
- There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 4.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE ID: CVE-2026-63143
Problem Type: CWE-862 - Missing Authorization
Impact: CAPEC-122 - Privilege Abuse