CVE-2026-63141: Kibana Auth Bypass Vulnerability

CVE-2026-63141 Overview

CVE-2026-63141 is a Missing Authorization vulnerability [CWE-862] in Elastic Kibana. Authenticated users can access and modify Cloud Connect configuration and service settings without holding the required feature privileges. The flaw exists in insufficiently protected product endpoints that fail to enforce authorization checks on incoming requests.

Elastic addressed the issue in Kibana 9.3.8 and 9.4.4 under advisory ESA-2026-65. Successful exploitation requires low-privileged authenticated access over the network and does not require user interaction.

Critical Impact
Authenticated users without Cloud Connect privileges can read and alter Cloud Connect configuration and service settings, undermining tenant separation of duties in Kibana deployments.

Affected Products

Elastic Kibana versions prior to 9.3.8
Elastic Kibana 9.4.x versions prior to 9.4.4
Kibana deployments with Cloud Connect functionality enabled

Discovery Timeline

2026-07-21 - CVE-2026-63141 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63141

Vulnerability Analysis

The vulnerability resides in Kibana endpoints that expose Cloud Connect configuration and service settings. These endpoints accept requests from any authenticated Kibana user without verifying that the caller holds the specific feature privileges required to view or modify Cloud Connect resources.

An attacker who already has a valid Kibana account, even one provisioned with minimal role assignments, can issue direct HTTP requests to the affected endpoints. The server processes these requests and returns configuration data or applies attacker-supplied changes. This breaks the Kibana role-based access control model, which is designed to gate Cloud Connect operations behind dedicated privileges.

The impact spans confidentiality, integrity, and availability at a limited scope. Attackers can disclose Cloud Connect settings, tamper with service configuration, or disrupt connected cloud integrations by changing operational parameters. See the Elastic Security Update ESA-2026-65 for vendor detail.

Root Cause

The root cause is missing server-side authorization enforcement on the Cloud Connect API surface. The endpoints authenticate the session but never evaluate whether the calling user's role grants the Cloud Connect feature privilege before executing the requested action.

Attack Vector

Exploitation occurs over the network against a reachable Kibana instance. The attacker must first authenticate with any valid Kibana credential, then submit crafted HTTP requests directly to the Cloud Connect endpoints, bypassing the UI-level privilege checks that would normally hide these controls.

No verified public proof-of-concept code is available. Refer to the vendor advisory for technical details about the vulnerable endpoints.

Detection Methods for CVE-2026-63141

Indicators of Compromise

Unexpected changes to Cloud Connect configuration performed by user accounts that lack Cloud Connect feature privileges.
Kibana audit log entries showing successful GET or POST requests to Cloud Connect administrative endpoints from low-privileged users.
Newly created or modified Cloud Connect service settings without a corresponding privileged administrator action.

Detection Strategies

Enable and forward the Kibana audit log, then alert on Cloud Connect endpoint access by any account outside a known administrator allowlist.
Correlate authentication events with subsequent Cloud Connect API calls to identify privilege boundary crossings.
Baseline normal Cloud Connect administrative activity and flag deviations in request frequency, source IP, or user agent.

Monitoring Recommendations

Ingest Kibana audit and access logs into a centralized analytics platform for retention and query.
Monitor for Kibana version banners still reporting versions below 9.3.8 or 9.4.4 on internal scans.
Track HTTP status codes on Cloud Connect endpoints for spikes in successful responses to non-administrator sessions.

How to Mitigate CVE-2026-63141

Immediate Actions Required

Upgrade Kibana to version 9.3.8, 9.4.4, or later per Elastic Security Update ESA-2026-65.
Review all Kibana user accounts and remove any that are not required, reducing the pool of authenticated attackers.
Audit recent Cloud Connect configuration changes and revert any unauthorized modifications.

Patch Information

Elastic released fixed builds 9.3.8 and 9.4.4 that enforce the required feature privileges on Cloud Connect endpoints. Apply the vendor-supplied packages through your standard Elastic Stack update process and verify the running version after restart.

Workarounds

Restrict network access to Kibana so that only trusted administrative networks can reach the management endpoints.
Enforce strong authentication and short session lifetimes to limit exposure from compromised low-privileged accounts.
Disable Cloud Connect functionality in environments that do not require it until the patch is applied.

bash

# Verify the installed Kibana version meets the fixed release
curl -sk -u "$KBN_USER:$KBN_PASS" \
  https://kibana.example.local:5601/api/status \
  | jq '.version.number'

# Expected output: "9.3.8", "9.4.4", or later