AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticCVE-2026-63138

Elastic Kibana: information disclosure

Elastic

CVE-2026-63138 · Published Sep 1, 2026 · updated Sep 2, 2026

Medium6.5
No fix yet
Elastic advisory

Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic, returning data the user is not authorized to read.

Affected versions

PackageAffectedFixed in
Kibana
Product
>= 9.4.0, <= 9.4.4No fix yet
<= 9.5.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-943

More Elastic advisories

All Elastic
Medium 5.4Sep 1Elasticsearch: missing authorizationCVE-2026-78607no fix yetMedium 6.5Sep 1Elastic Kibana: missing authorizationCVE-2026-78608no fix yetHigh 7.3Sep 1Elastic Kibana: path traversalCVE-2026-78592no fix yetMedium 4.3Sep 1Elastic Kibana: missing authorizationCVE-2026-78597no fix yetMedium 4.3Sep 1Elastic Kibana: missing authorizationCVE-2026-78603no fix yetMedium 5.9Sep 1Elasticsearch: request smugglingCVE-2026-78605no fix yet