# Question about Kibana vulnerability (CVE-2024-37287)

**URL:** <https://discuss.elastic.co/t/question-about-kibana-vulnerability-cve-2024-37287/365448>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [August 23, 2024, 9:38am UTC](https://discuss.elastic.co/t/question-about-kibana-vulnerability-cve-2024-37287/365448 "2024-08-23T09:38:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![YUUTA.INOUE-JPN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuuta.inoue-jpn/32/117963_2.png) [@YUUTA.INOUE-JPN](https://discuss.elastic.co/u/YUUTA.INOUE-JPN)\
**Post date:** [August 23, 2024, 9:38am UTC](https://discuss.elastic.co/t/question-about-kibana-vulnerability-cve-2024-37287/365448/1 "2024-08-23T09:38:44Z")

</div>

Hello from Japan  
I'm concerned about Elastic's security announcement.  
Specifically, it's about the Kibana vulnerability (CVE-2024-37287).

I created an elasticsearch.serviceAccountToken for Kibana using the command below.

If I access Elasticsearch with that token, am I correct in thinking that I cannot access the hidden index [.ml-anomalies\*] (no permissions)?

```auto
- Command to create an elasticsearch.serviceAccountToken for Kibana

POST /_security/service/elastic/kibana/credential/token/<kibana_name>

```

I need help from all the great Elastic engineers  
Regards.