AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticCVE-2026-63141

Elastic Kibana: missing authorization

Elastic

CVE-2026-63141 · Published Jul 21, 2026 · updated Aug 6, 2026

Medium6.3
No fix yet
Elastic advisory

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

Affected versions

PackageAffectedFixed in
Kibana
Product
>= 9.4.0, <= 9.4.3No fix yet
>= 9.3.0, <= 9.3.7No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-862

More Elastic advisories

All Elastic
Medium 5.0Jul 21Elastic Kibana: improper authorizationCVE-2026-63142no fix yetMedium 4.3Jul 21Elastic Kibana: missing authorizationCVE-2026-63143no fix yetMedium 6.5Jul 21Elasticsearch: denial of serviceCVE-2026-63144no fix yetMedium 4.3Jul 21Elastic Kibana: improper authorizationCVE-2026-63145no fix yetMedium 4.3Jul 21Elastic Kibana: information disclosureCVE-2026-63259no fix yetMedium 6.5Jul 21Elastic Kibana: resource exhaustionCVE-2026-63260no fix yet