Elastic Kibana 8.x and 9.x face privilege escalation and DoS vulnerabilities
Elastic Kibana versions 8.x and 9.x contain multiple vulnerabilities allowing privilege escalation, remote DoS, and data confidentiality breaches.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 10 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The French CERT (ANSSI) has issued an advisory regarding multiple security vulnerabilities discovered in Elastic Kibana. The affected versions include Kibana 8.x prior to 8.19.16, 9.4.x prior to 9.4.2, and 9.x prior to 9.3.5. The vulnerabilities span a range of attack vectors including server-side request forgery (SSRF), cross-site scripting (XSS), and security policy bypass mechanisms.
The potential impacts of these vulnerabilities are significant, enabling attackers to achieve privilege escalation, conduct remote denial of service attacks, compromise data confidentiality and integrity, and bypass established security policies. Elastic has released security updates addressing ten distinct CVEs (CVE-2026-33462 through CVE-2026-49095) across multiple security advisories published on May 28, 2026.
Organizations running affected Kibana versions should prioritize patching to the latest releases. The vendor has published comprehensive security bulletins with remediation guidance. Given Kibana's role as a data visualization and exploration tool often handling sensitive organizational data, exploitation of these vulnerabilities could provide attackers with significant access to business-critical information and system controls.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Kibana/Node.js Server Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or scripting interpreter spawned as a child of the Kibana/Node.js server process, consistent with post-exploitation of a Kibana server-side vulnerability leading to command execution and potential privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Kibana/Node.js Server Process
id: 8ffeead7-ff26-5e6a-b92c-5f64e129f412
status: experimental
description: 'Detects execution of shell or scripting interpreters as a direct child
of a Kibana or Node.js server process.
Kibana is a Node.js-based web application; unexpected shell spawning from its process
tree can indicate
exploitation of a server-side vulnerability (e.g. SSRF chained to RCE, or security
policy bypass) as
described in recent Kibana advisories, potentially leading to privilege escalation
on the host.
'
references:
- https://www.cert.ssi.gouv.fr/
author: Vorant
tags:
- attack.t1190
- attack.t1068
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- node
- kibana
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
- /curl
- /wget
- /nc
- /ncat
filter:
CommandLine|contains:
- --version
- healthcheck
condition: selection_parent and selection_child and not filter
falsepositives:
- Legitimate Kibana plugin update or reporting scripts that shell out to helper binaries
- Administrative health-check or monitoring scripts invoked from the Kibana service
account
level: high
Kibana Process Outbound Connection to Cloud Metadata or Internal Loopback Service
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the Kibana/Node.js server process making an outbound connection to cloud instance metadata addresses or unusual loopback/internal ports, consistent with SSRF exploitation of a Kibana server-side request forgery vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kibana Process Outbound Connection to Cloud Metadata or Internal Loopback Service
id: 0c2bb8cb-6461-553f-b138-af02ad5424ce
status: experimental
description: 'Detects the Kibana/Node.js server process initiating outbound connections
to cloud metadata
services (e.g. 169.254.169.254) or unexpected internal loopback ports. This pattern
is consistent
with exploitation of an SSRF vulnerability in Kibana, as described in ANSSI advisories
covering
Kibana 8.x/9.x, which can be used to reach internal services or steal cloud credentials.
'
references:
- https://www.cert.ssi.gouv.fr/
author: Vorant
tags:
- attack.t1190
- attack.t1498
logsource:
category: network_connection
product: linux
detection:
selection:
Image|contains:
- node
- kibana
metadata_target:
DestinationIp: 169.254.169.254
loopback_target:
DestinationIp|startswith:
- '127.'
DestinationPort:
- 22
- 3306
- 5432
- 6379
- 9200
condition: selection and (metadata_target or loopback_target)
falsepositives:
- Legitimate Kibana deployments running on cloud instances that intentionally query
instance metadata for configuration
- Local monitoring integrations that connect Kibana to co-located databases or Elasticsearch
on loopback addresses
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0661
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs