Elastic Kibana versions 8.x and 9.x contain multiple vulnerabilities allowing privilege…
Elastic Kibana versions 8.x and 9.x contain multiple vulnerabilities allowing privilege escalation, remote DoS, and data confidentiality breaches.
The French CERT (ANSSI) has issued an advisory regarding multiple security vulnerabilities discovered in Elastic Kibana. The affected versions include Kibana 8.x prior to 8.19.16, 9.4.x prior to 9.4.2, and 9.x prior to 9.3.5. The vulnerabilities span a range of attack vectors including server-side request forgery (SSRF), cross-site scripting (XSS), and security policy bypass mechanisms.
The potential impacts of these vulnerabilities are significant, enabling attackers to achieve privilege escalation, conduct remote denial of service attacks, compromise data confidentiality and integrity, and bypass established security policies. Elastic has released security updates addressing ten distinct CVEs (CVE-2026-33462 through CVE-2026-49095) across multiple security advisories published on May 28, 2026.
Organizations running affected Kibana versions should prioritize patching to the latest releases. The vendor has published comprehensive security bulletins with remediation guidance. Given Kibana's role as a data visualization and exploration tool often handling sensitive organizational data, exploitation of these vulnerabilities could provide attackers with significant access to business-critical information and system controls.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Kibana/Node.js Server Process
Detects a shell or scripting interpreter spawned as a child of the Kibana/Node.js server process, consistent with post-exploitation of a Kibana server-side vulnerability leading to command execution and potential privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Kibana/Node.js Server Process
id: 8ffeead7-ff26-5e6a-b92c-5f64e129f412
status: experimental
description: 'Detects execution of shell or scripting interpreters as a direct child
of a Kibana or Node.js server process.
Kibana is a Node.js-based web application; unexpected shell spawning from its process
tree can indicate
exploitation of a server-side vulnerability (e.g. SSRF chained to RCE, or security
policy bypass) as
described in recent Kibana advisories, potentially leading to privilege escalation
on the host.
'
references:
- https://www.cert.ssi.gouv.fr/
author: Vorant
tags:
- attack.t1190
- attack.t1068
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- node
- kibana
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
- /curl
- /wget
- /nc
- /ncat
filter:
CommandLine|contains:
- --version
- healthcheck
condition: selection_parent and selection_child and not filter
falsepositives:
- Legitimate Kibana plugin update or reporting scripts that shell out to helper binaries
- Administrative health-check or monitoring scripts invoked from the Kibana service
account
level: high
Kibana Process Outbound Connection to Cloud Metadata or Internal Loopback Service
Detects the Kibana/Node.js server process making an outbound connection to cloud instance metadata addresses or unusual loopback/internal ports, consistent with SSRF exploitation of a Kibana server-side request forgery vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kibana Process Outbound Connection to Cloud Metadata or Internal Loopback Service
id: 0c2bb8cb-6461-553f-b138-af02ad5424ce
status: experimental
description: 'Detects the Kibana/Node.js server process initiating outbound connections
to cloud metadata
services (e.g. 169.254.169.254) or unexpected internal loopback ports. This pattern
is consistent
with exploitation of an SSRF vulnerability in Kibana, as described in ANSSI advisories
covering
Kibana 8.x/9.x, which can be used to reach internal services or steal cloud credentials.
'
references:
- https://www.cert.ssi.gouv.fr/
author: Vorant
tags:
- attack.t1190
- attack.t1498
logsource:
category: network_connection
product: linux
detection:
selection:
Image|contains:
- node
- kibana
metadata_target:
DestinationIp: 169.254.169.254
loopback_target:
DestinationIp|startswith:
- '127.'
DestinationPort:
- 22
- 3306
- 5432
- 6379
- 9200
condition: selection and (metadata_target or loopback_target)
falsepositives:
- Legitimate Kibana deployments running on cloud instances that intentionally query
instance metadata for configuration
- Local monitoring integrations that connect Kibana to co-located databases or Elasticsearch
on loopback addresses
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0661
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free