CVE-2026-63138
Undergoing Analysis Undergoing Analysis - In Progress

Improper Input Handling Leads to NoSQL Injection in Kibana

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description
Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic, returning data the user is not authorized to read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-63138
EUVD
EUVD-2026-69575

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
elastic kibana From 9.4.0 (inc) to 9.4.4 (inc)
elastic kibana 9.5.0
elastic kibana 9.4.5
elastic kibana 9.5.1
elastic kibana *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63138 is a NoSQL injection vulnerability in Kibana versions 9.4.0 through 9.4.4 and 9.5.0. It occurs due to improper neutralization of special elements in data query logic (CWE-943). An authenticated user with access to query functionality can submit crafted input to alter query logic, leading to unauthorized data disclosure.

Detection Guidance

To detect CVE-2026-63138, check if your Kibana instance is running a vulnerable version (9.4.0 to 9.4.4 or 9.5.0). Verify the version with: curl -X GET "http://localhost:5601/api/console/api_server" | grep version. If the version is vulnerable, upgrade to 9.4.5 or 9.5.1 immediately.

Impact Analysis

If exploited, this vulnerability allows an attacker to access sensitive data they are not authorized to view. This could include confidential information stored in Kibana, potentially leading to data breaches or compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations may face legal penalties, reputational damage, and loss of customer trust if such breaches occur.

Mitigation Strategies
  • Upgrade Kibana to version 9.4.5 or 9.5.1 or later to resolve the vulnerability.
  • If upgrading is not possible, restrict access to authenticated users with query functionality permissions to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart