Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-13T20:17:27.157Z",
  "pubdate": "2026-08-13T20:17:27.157Z",
  "executiveSummary": "An Authorization Bypass Through User-Controlled Key vulnerability, classified as CWE-639, has been identified in Kibana. This security flaw allows unauthorized query execution against Elastic Agents assigned to a Kibana space for which the requesting user lacks legitimate access, aligning with CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs).\nThe primary impact of this vulnerability involves cross-space information disclosure. Specifically, a low-privileged or restricted user who possesses authorization to run Osquery live queries within a single authorized Kibana space can manipulate user-controlled keys to execute queries against hosts belonging to entirely different, isolated spaces.\nThe affected product is Kibana, interacting with Elastic Agents and Osquery management features. Risk implications include unauthorized data exposure, as the resulting information from targeted hosts is transmitted directly to the Osquery results data stream.\nExploitation requirements dictate that the attacker must already possess authorization to execute Osquery live queries in at least one valid space. The attacker leverages this legitimate capability to exploit insufficient access control checks on user-controlled parameters, facilitating unauthorized cross-space task execution without triggering standard boundary restrictions.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate server-side validation of user-supplied keys and parameters during the processing of Osquery live queries in Kibana. The application fails to properly enforce Access Control Lists (ACLs) against the target context, allowing a user-controlled identifier to dictate the execution scope rather than validating the user's explicit permissions against the assigned Kibana space of the destination Elastic Agent.\nThe vulnerable component resides within the Kibana subsystem responsible for routing Osquery live queries to Elastic Agents across distinct Kibana spaces. The architecture incorrectly trusts user-supplied references concerning space assignment, bypassing the intended logical boundaries that segregate multi-tenant or role-based environments.\nThe attack flow proceeds as follows: First, an authenticated user identifies or possesses valid authorization to execute Osquery live queries within a permitted Kibana space. Second, the user crafts a malicious or modified request containing a user-controlled key that references a separate, restricted Kibana space and its associated Elastic Agents. Third, the Kibana backend processes the request without adequately verifying whether the requesting user's security context holds privileges over the targeted space. Fourth, the query is dispatched to Elastic Agents residing in the unauthorized space.\nUpon execution by the unintended Elastic Agents, the collected telemetry and query output are written back to the Osquery results data stream. Finally, the malicious user retrieves the sensitive host data from the data stream, achieving unauthorized information disclosure across security boundaries.\nAuthentication requirements dictate that the attacker must be authenticated to Kibana and hold specific permissions to run Osquery live queries in an authorized space. However, privilege requirements are insufficiently enforced across spaces, allowing horizontal or vertical privilege escalation relative to space boundaries. Network exposure is inherent to the standard Kibana interface accessible to authenticated users."
}