Description

Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-13T20:17:26.017Z",
  "pubdate": "2026-08-13T20:17:26.017Z",
  "executiveSummary": "A Cross-Site Request Forgery (CWE-352) vulnerability exists in the Kibana visualization component, potentially leading to privilege escalation via Cross Site Request Forgery (CAPEC-62). The vulnerability allows a malicious actor with permissions to create visualizations to construct and save a specially crafted Vega visualization.\nWhen an unsuspecting victim with higher privileges opens the malicious visualization within their active Kibana session, the component executes authenticated requests within the context of the viewing user's session.\nThe primary impact of this flaw includes unauthorized actions performed on behalf of the victim, potentially leading to unauthorized privilege escalation or state modifications within the affected Kibana instance.\nExploitation requires user interaction, specifically that an authenticated victim views the malicious Vega visualization crafted and stored by the attacker.",
  "technicalDetails": "The vulnerability stems from an insufficient validation of request authenticity within Kibana, specifically tied to how the visualization subsystem handles state and renders Vega-based visualizations.\nThe vulnerable component is the Kibana visualization module, specifically handling Vega visualization parsing and rendering.\nAn attacker must possess sufficient permissions to create and save visualizations within the target Kibana environment.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious Vega visualization containing embedded scripts or definitions designed to trigger unauthorized API requests when rendered. Second, the attacker saves this visualization within the Kibana workspace. Third, a victim user with higher privileges (such as administrative or broader operational access) views the compromised Vega visualization. Fourth, upon rendering, the visualization executes unauthorized authenticated HTTP requests against the Kibana backend leveraging the victim's active session cookies or authentication tokens.\nBecause the requests originate from the victim's browser, the Kibana server processes them as legitimate user-initiated actions, bypassing standard access control checks intended to prevent unauthorized modifications.\nThe post-exploitation impact includes the execution of unintended actions in the context of the authenticated victim, which can be leveraged for privilege escalation or administrative compromise depending on the victim's access rights."
}