CVE-2026-63141

Analyzed Analyzed - Analysis Complete

Missing Authorization in Kibana Allows Unauthorized Cloud Connect Configuration Changes

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Elastic

Description

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-63141

EUVD

EUVD-2026-46636

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.4.0 (inc) to 9.4.4 (exc)
elastic	kibana	From 9.3.0 (inc) to 9.3.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Authorization issue in Kibana, classified as CWE-862. It allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges. This happens because certain product endpoints are insufficiently protected, enabling unauthorized direct requests.

Detection Guidance

To detect this vulnerability, monitor Kibana logs for unauthorized access attempts to Cloud Connect configuration endpoints. Check for unusual PUT or POST requests to paths like /api/cloud/connect or /api/cloud/settings. Use tools like curl to test if endpoints like /api/features/cloud_connect or /api/cloud/connect are accessible without proper authorization headers.

Impact Analysis

An attacker with authenticated access could exploit this to change Cloud Connect settings or configurations, potentially leading to data leaks, service disruptions, or unauthorized access to sensitive information. The impact includes low confidentiality, integrity, and availability losses.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access or modifications to sensitive data, which may breach GDPR or HIPAA. Organizations using Kibana must address this to maintain data protection and regulatory adherence.

Mitigation Strategies

Update Kibana to the latest patched version immediately to address the missing authorization issue. Ensure all authenticated users have only the minimum required privileges and review Cloud Connect configuration access controls.

Hi! I’m here to help you understand CVE-2026-63141. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70