Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure
Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic, returning data the user is not authorized to read.
Affected Versions:
- 9.x:
- All versions from 9.4.0 up to and including 9.4.4
- Version 9.5.0
Users on the 8.x release line are not affected. The functionality that contains this vulnerability was introduced in 9.4.0 and is not present in 8.x.
Affected Configurations:
Kibana deployments where the affected query management capability is enabled and authenticated users hold access to the query interfaces it exposes.
Solutions and Mitigations:
The issue is resolved in Kibana versions 9.4.5 and 9.5.1.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE ID: CVE-2026-63138
Problem Type: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Impact: CAPEC-676 - NoSQL Injection