Description

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-13T20:17:27.403Z",
  "pubdate": "2026-08-13T20:17:27.403Z",
  "executiveSummary": "An access control vulnerability exists in the Kibana Observability Onboarding flow state management mechanism.\nThe vulnerability allows authenticated users with generic read access to a space to access, read, and manipulate the onboarding state data belonging to other users.\nThe affected product is Kibana, specifically impacting the Observability Onboarding flow routing and state storage components.\nThe risk implications involve unauthorized data exposure, state tampering, and potential denial-of-service conditions against victim user interfaces.\nAn attacker must possess authenticated access with generic read privileges to the targeted Kibana space to execute the attack.\nExploitation requires the attacker to interact directly with the vulnerable API routes governing the onboarding flow state.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient authorization checks within the Kibana routes responsible for reading and updating the Observability Onboarding flow state.\nThe state persisted by the onboarding flow is not cryptographically or logically bound to the specific user session or user identifier that originally initialized the flow.\nFurthermore, the endpoints processing read and update operations fail to validate whether the requesting user context owns or has administrative rights over the targeted onboarding resource.\nConsequently, an authenticated attacker holding only baseline generic read access within a shared space can enumerate and discover active onboarding flows created by other users.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies or enumerates the object identifiers associated with foreign Observability Onboarding flows via the exposed reading routes.\nSecond, the attacker issues crafted HTTP requests to the state-update routes, supplying arbitrary progress data payloads.\nThird, the backend application accepts the incoming write operations without ownership validation, overwriting the legitimate user's state data.\nAdditionally, an attacker can intentionally inject malformed or tampered progress structures, inducing unhandled application exceptions when the legitimate owner subsequently attempts to render the onboarding view, resulting in a localized server error and interface denial of service.\nThe attack vector operates via network exposure over the standard Kibana HTTP interface, requiring an authenticated low-privileged user account with standard space read capabilities."
}