CVE-2026-63143 Overview
CVE-2026-63143 is a Missing Authorization vulnerability [CWE-862] in Elastic Kibana. A user with limited feature privileges can retrieve workflow execution outputs within their Kibana space without holding the authorization required by the documented API. The exposed data may include results returned by workflow steps, such as content pulled from connected data sources the caller cannot otherwise reach. Elastic addressed the flaw in Kibana 9.3.8 and 9.4.4 through security update ESA-2026-67.
Critical Impact
Authenticated low-privilege Kibana users can read workflow execution outputs containing sensitive data from connected sources, bypassing intended API authorization checks.
Affected Products
- Elastic Kibana versions prior to 9.3.8
- Elastic Kibana 9.4.x versions prior to 9.4.4
- Kibana deployments using the Workflows feature
Discovery Timeline
- 2026-07-21 - CVE-2026-63143 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-63143
Vulnerability Analysis
The flaw resides in the Kibana Workflows subsystem, which allows users to run multi-step automations that query connected data sources and produce structured outputs. The documented API enforces feature privileges before returning workflow execution results. However, an alternate access path retrieves the same execution outputs without evaluating those privilege checks.
An authenticated user with only limited feature privileges in a Kibana space can therefore fetch outputs produced by workflows they cannot legitimately invoke. Because workflow steps often call privileged connectors such as Elasticsearch queries, third-party integrations, or webhooks, the returned outputs may embed data the caller has no direct entitlement to view.
Root Cause
The root cause is Missing Authorization [CWE-862] on a workflow execution output retrieval path. The affected code returns stored step outputs based on space membership and object identifiers rather than validating the caller's feature privileges against the workflow. This corresponds to Privilege Abuse [CAPEC-122], where a legitimate account exercises access it should not possess.
Attack Vector
Exploitation requires network access to Kibana and valid credentials for a user assigned to the target space. No user interaction is required beyond the attacker's own API requests. The attacker enumerates or references workflow execution identifiers within their accessible space and issues requests to the vulnerable endpoint, receiving output payloads that include upstream data from privileged connectors.
The vulnerability affects confidentiality only. Integrity and availability of Kibana and its underlying data are not impacted by this specific issue.
Detection Methods for CVE-2026-63143
Indicators of Compromise
- Requests from low-privilege user accounts to workflow execution output endpoints in Kibana audit logs.
- Access patterns where a single account retrieves execution outputs for workflows the user did not create or trigger.
- Anomalous spikes in workflow output read operations preceding lateral movement or data staging events.
Detection Strategies
- Enable Kibana audit logging and alert on workflow object reads by principals lacking the corresponding workflow feature privilege.
- Correlate Kibana authentication events with subsequent workflow API calls to identify enumeration behavior.
- Baseline normal per-user workflow interaction volumes and flag statistical outliers.
Monitoring Recommendations
- Forward Kibana and Elasticsearch audit logs to a centralized analytics platform such as Singularity Data Lake for OCSF-normalized querying and long-term retention.
- Monitor for the Kibana build versions in the /api/status endpoint to confirm patched deployments across the fleet.
- Review connector configurations to identify workflows that expose high-value data sources and prioritize monitoring on those objects.
How to Mitigate CVE-2026-63143
Immediate Actions Required
- Upgrade Kibana to version 9.3.8, 9.4.4, or later as described in Elastic Security Update ESA-2026-67.
- Audit existing workflow definitions and remove or restrict workflows whose outputs contain sensitive connector data until patches are applied.
- Review Kibana space membership and revoke access for accounts that do not require workflow visibility.
Patch Information
Elastic released fixed builds in Kibana 9.3.8 and 9.4.4. The advisory ESA-2026-67 documents the affected versions and remediation. Operators of Elastic Cloud instances should confirm their deployments have received the update; self-managed customers should plan an upgrade window and validate cluster health post-upgrade.
Workarounds
- Restrict the Workflows feature privilege at the space level to trusted users only until the upgrade is complete.
- Place Kibana behind a reverse proxy or WAF and block requests to workflow execution output paths from non-privileged principals.
- Rotate secrets stored in workflow connectors if audit logs indicate unauthorized output reads occurred prior to patching.
# Verify Kibana version after upgrade
curl -u <admin_user> -X GET "https://<kibana-host>:5601/api/status" \
-H "kbn-xsrf: true" | jq '.version.number'
# Expected output: "9.3.8" or "9.4.4" or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
