Kibana 9.4.1 xpack disabled not working anymore

Elastic Stack Kibana
1

I can't access Kibana with xpack security disabled since upgrading my test setup to 9.4.1

I'm proxying Kibana with nginx

2

Can you provide more details from kibana.log?

3

Sure, same as here

Setting the password for elastic and kibana_system and enabling xpack seems to at least allow me to access the kibana instance, however for dev work it would be great not to have to worry about xpack.

{
  "http": {
    "response": {
      "status_code": 500
    },
    "request": {
      "method": "get",
      "path": "/app/{id}/{any*}"
    }
  },
  "error": {
    "message": "{\"error\":\"no handler found for uri [/_security/profile/u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0?data=kibana.userSettings] and method [GET]\"}"
  },
  "service": {
    "version": "9.4.1",
    "type": "kibana",
    "state": "available",
    "node": {
      "roles": [
        "background_tasks",
        "ui"
      ]
    },
    "id": "ohvI5dqKTj-lfM4SXTl9jw"
  },
  "ecs": {
    "version": "9.3.0"
  },
  "@timestamp": "2026-05-18T14:54:32.044+10:00",
  "message": "500 Server Error",
  "log": {
    "level": "ERROR",
    "logger": "http"
  },
  "process": {
    "pid": 23545,
    "uptime": 485.247554952
  },
  "trace": {
    "id": "ce1b5f71c58f59f151cc626e86182dba"
  },
  "transaction": {
    "id": "5ff7736e2b52d840"
  }
}
```
4

I have pinged the Kibana team internally.

5

Hey @VamPikmin ,

Can you share a bit more details about your proxy setup? Does the proxy attach "Authorization" HTTP header or something along these lines?

6

That same path /app/{id}/{any*}", came up in a different thread last week, where while troubleshooting that issue we possibly hit this one too.

Note OP in that other thread deemed a : character in his password as the core issue, and there were other unrelated complications, but he was also using a proxy (apache in his case).

7

This was the problem in our case. After configuring Nginx to strip the Authorization header (we use Nginx basic auth to secure kibana endpoint at reverse proxy level), 9.4 also works correctly.

8

Thanks for confirming. We'll keep discussing the issue, workarounds, and the possibility of restoring the previous behavior in https://github.com/elastic/kibana/issues/268959. I'll mark the last message in this thread as a solution for now.

9

Apologies,

Yes I'm using nginx and stripping the header resolves the issue


proxy_set_header Authorization "";

Thanks