CVE-2026-63137: Elastic Kibana Privilege Escalation Flaw

CVE-2026-63137 Overview

CVE-2026-63137 is an incorrect authorization vulnerability [CWE-863] in Elastic Kibana. A user with workflow edit permissions can cause scheduled workflow executions to run under the privileges of a different, higher-privileged user. This allows the attacker to read and modify data outside their own authorization scope. Elastic addressed the flaw in Kibana 9.4.3 through security advisory ESA-2026-61. The issue maps to CAPEC-180 (Exploiting Incorrectly Configured Access Control Security Levels) and is exploitable over the network with low privileges and no user interaction.

Critical Impact
An authenticated Kibana user with workflow edit rights can escalate privileges by hijacking scheduled workflow execution contexts, gaining unauthorized read and write access to protected data.

Affected Products

Elastic Kibana (prior to 9.4.3)
Deployments using the workflows feature with scheduled executions
Multi-tenant Kibana environments with mixed-privilege users

Discovery Timeline

2026-09-01 - CVE-2026-63137 published to NVD
2026-09-02 - Last updated in NVD database
ESA-2026-61 - Elastic releases Kibana 9.4.3 with security fix

Technical Details for CVE-2026-63137

Vulnerability Analysis

The vulnerability resides in how Kibana evaluates authorization for scheduled workflow executions. Workflows in Kibana can be edited by users granted workflow edit permissions. When such a workflow runs on a schedule, the execution context is not correctly bound to the requesting editor's privileges. Instead, the scheduler resolves execution to a different, higher-privileged principal.

This mismatch between the acting user and the effective execution identity constitutes broken access control. An attacker with only workflow edit rights can craft workflow steps that read indices, invoke APIs, or mutate data that their own role does not permit. The confidentiality and integrity impact is high because the workflow runs with elevated permissions across the Kibana and Elasticsearch stack.

Root Cause

The root cause is an authorization check that trusts the workflow definition's stored owner or scheduler identity rather than re-validating the acting user's rights at execution time. Kibana fails to enforce that scheduled runs operate only within the permission scope of the user who authored or last modified the workflow.

Attack Vector

Exploitation requires an authenticated Kibana account holding workflow edit permissions. The attacker modifies a workflow definition to include steps that access resources beyond their authorization scope. When the workflow triggers on its schedule, Kibana executes those steps under a higher-privileged identity. No user interaction is required and the attack is delivered over the network.

No public proof-of-concept is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Elastic Security Update ESA-2026-61 for vendor technical details.

Detection Methods for CVE-2026-63137

Indicators of Compromise

Scheduled workflow executions performing actions or queries inconsistent with the editing user's normal role scope
Workflow audit entries showing edits by lower-privileged users followed by scheduled runs accessing restricted indices
Unexpected changes to indices, saved objects, or dashboards that trace back to workflow execution IDs
New or recently modified workflows containing steps that reference privileged APIs or protected data sources

Detection Strategies

Enable Kibana and Elasticsearch audit logging and correlate workflow.edit events with subsequent scheduled workflow.execute events across differing user contexts.
Baseline each user's expected data access patterns and alert when workflow-driven activity exceeds that baseline.
Review all workflows for steps that touch indices or APIs outside the author's role definition.

Monitoring Recommendations

Ship Kibana audit logs to a centralized SIEM and retain workflow execution history for forensic review.
Alert on privilege deltas where the acting user on a workflow differs from the effective execution identity.
Monitor Elastic security advisory channels for follow-up guidance on ESA-2026-61.

How to Mitigate CVE-2026-63137

Immediate Actions Required

Upgrade Kibana to version 9.4.3 or later as specified in ESA-2026-61.
Inventory all users granted workflow edit permissions and remove the privilege where not required.
Audit existing scheduled workflows for suspicious steps introduced by lower-privileged editors and disable any that appear tampered with.
Rotate credentials and API keys that may have been accessed through malicious workflow executions.

Patch Information

Elastic released the fix in Kibana 9.4.3. Apply the update per the Elastic Security Update ESA-2026-61. Verify the deployed version in the Kibana Stack Management console after upgrade.

Workarounds

Restrict the workflow edit privilege to trusted administrators until the patch is applied.
Disable scheduled workflow execution in environments where the feature is not required.
Segment Kibana spaces and roles so that workflow editors cannot indirectly reach sensitive indices even if execution context is elevated.

bash

# Verify Kibana version after upgrade
curl -u <admin>:<password> -X GET "https://<kibana-host>:5601/api/status" | jq '.version.number'

# Expected output: 9.4.3 or later