CVE-2025-37728: CrowdStrike Connector Credential Leak Flaw

CVE-2025-37728 Overview

CVE-2025-37728 is an insufficiently protected credentials vulnerability [CWE-522] affecting the Crowdstrike connector in Elastic Kibana. The flaw allows an authenticated user in one Kibana space to access cached Crowdstrike credentials that belong to a connector configured in another space. An attacker creates and runs a new Crowdstrike connector in a space they can access, and the underlying framework exposes credentials cached from a connector in a different space. This cross-space credential exposure breaks Kibana's space-based access boundaries and can lead to unauthorized use of Crowdstrike API keys.

Critical Impact
An authenticated Kibana user with permissions in any space can retrieve cached Crowdstrike connector credentials from other spaces, resulting in exposure of privileged endpoint security API credentials.

Affected Products

Elastic Kibana Crowdstrike connector (versions prior to 8.18.8)
Elastic Kibana Crowdstrike connector (versions prior to 8.19.5 and 9.0.8)
Elastic Kibana Crowdstrike connector (versions prior to 9.1.5)

Discovery Timeline

2025-10-07 - CVE-2025-37728 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37728

Vulnerability Analysis

The vulnerability resides in the Crowdstrike connector implementation within Kibana. Connectors in Kibana store integration credentials, such as Crowdstrike API keys, as encrypted saved objects scoped to a specific space. Spaces provide logical isolation between tenants and workloads.

The Crowdstrike connector caches credentials at runtime in a manner that does not enforce the originating space boundary. When a user with connector-creation privileges in any space instantiates a new Crowdstrike connector and executes it, the connector runtime returns cached credentials that were originally populated by a connector from a separate space. The attacker gains access to Crowdstrike API tokens they were never granted.

Exploitation requires an authenticated Kibana account and user interaction with the connector interface, which limits the attack to insiders or accounts obtained through prior compromise. However, Crowdstrike API credentials grant privileged access to endpoint telemetry and response actions, so the downstream impact extends well beyond Kibana itself.

Root Cause

The defect is a credential caching implementation that fails to segregate cached secrets by Kibana space. The connector framework treats the cached credential store as global rather than space-scoped, violating the tenancy boundary established by Kibana spaces and mapping to [CWE-522] Insufficiently Protected Credentials.

Attack Vector

Exploitation occurs over the network against an authenticated Kibana session with low-privilege connector permissions in a target space. The attacker creates a Crowdstrike connector, triggers a run action, and observes or reuses the cached credentials returned by the shared cache. No local access to the Kibana host is required.

No verified public proof-of-concept code is available. Refer to the Elastic Security Update ESA-2025-19 for advisory-level technical details.

Detection Methods for CVE-2025-37728

Indicators of Compromise

Creation of new Crowdstrike connectors in Kibana spaces that historically do not use Crowdstrike integration.
Unexpected Crowdstrike API activity originating from Kibana service accounts, including read calls to detections, devices, or real-time response endpoints.
Kibana audit log entries showing connector.create or connector.execute events for the Crowdstrike type performed by users without a business need for that integration.

Detection Strategies

Enable and centralize Kibana audit logging, then alert on Crowdstrike connector creation and execution events correlated with the acting user and space.
Compare Crowdstrike Falcon API call sources against an allowlist of expected Kibana instances and service accounts.
Baseline the set of users authorized to manage Crowdstrike connectors and flag deviations.

Monitoring Recommendations

Forward Kibana audit logs and Crowdstrike Falcon audit events to a centralized analytics platform for correlation.
Monitor for API key usage from unexpected IP ranges or during off-hours windows.
Rotate and monitor Crowdstrike API keys used by Kibana connectors on a defined cadence.

How to Mitigate CVE-2025-37728

Immediate Actions Required

Upgrade Kibana to a fixed release: 8.18.8, 8.19.5, 9.0.8, or 9.1.5 or later.
Rotate all Crowdstrike API credentials configured in Kibana connectors, assuming prior exposure.
Review Kibana audit logs for unauthorized connector creation or execution across all spaces since the connector was first deployed.
Restrict connector management privileges to a minimal set of trusted administrators.

Patch Information

Elastic released fixed versions of Kibana that address the Crowdstrike connector credential caching flaw. See the Elastic Security Update ESA-2025-19 advisory for the complete list of fixed versions and upgrade guidance.

Workarounds

Remove Crowdstrike connectors from Kibana until the patched version is deployed.
Restrict the actions:all and connector creation privileges to trusted administrators only through Kibana role management.
Enforce space-level access controls so that low-privilege users cannot create arbitrary connectors.

bash

# Configuration example: restrict connector privileges via Kibana role API
curl -X PUT "https://kibana.example.com/api/security/role/no_connector_create" \
  -H "kbn-xsrf: true" -H "Content-Type: application/json" \
  -u admin:$KIBANA_ADMIN_PW \
  -d '{
    "kibana": [{
      "base": [],
      "feature": { "actions": ["read"] },
      "spaces": ["*"]
    }]
  }'