CVE-2026-63145: kibana from 7.14.0 (inclusive), before 8.19.19 (exclusive), from 9.0.0 (inclusive), before 9.3.8 (exclusive), from…

CVE-2026-63145. CVSS 3.1 base score 4.3 (MEDIUM, Vendor/CNA). EPSS 0.00268 (percentile 0.18029), scored 24-Oct-2026. Fixed version: 0b6bd198d583b8566336c0db61afb70b346c6882. Fixed version: 171dd53e53c29b91f45d2d87857a3f74db48cca5. Fixed version: 77cd231096e56b56ac1d24445a9430a252622e6d. Fixed version: 9bed9b7c05fe39507eb73d1a334ca96aa0c32cee. Fixed version: e39c92c646f9a6b1e4b7b68d9f59967bb77d5732. Fixed version: 08c91e2fed2dbb7bdca4ec70b32630356bbeef07.

Affected technology

kibana · from 7.14.0 (inclusive), before 8.19.19 (exclusive)
elastic

kibana · from 9.0.0 (inclusive), before 9.3.8 (exclusive)
elastic

kibana · from 9.4.0 (inclusive), before 9.4.4 (exclusive)
elastic

Kibana · 9.4.0 through 9.4.3, 9.0.0 through 9.3.7, 8.0.0 through 8.19.18
Elastic

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobs—including jobs in other spaces or belonging to other users—by leveraging Kibana's internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly. Vendor/CNA’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality and availability impact as none; integrity impact as low.

Published 25-Oct-2026 01:00 UTC

CWE: CWE-863
CCR priority: 17.3 /100 (P5)
CVSS 3.1: 4.3 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · Vendor/CNA
EPSS: 0.00268 · percentile 0.18029 · 2026-10-24
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
OSV.dev · Source record · observed 2026-10-24 16:38:25.544256+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-63145.html