Description

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-03T19:17:28.687Z",
  "pubdate": "2026-09-03T19:17:28.687Z",
  "executiveSummary": "This vulnerability involves an expression injection flaw within the Kibana Cribl integration, stemming from insufficient validation of configuration inputs.\nAn authenticated user with Kibana Fleet management privileges can leverage this oversight to inject arbitrary expressions into a server-side script template.\nThe primary impact is a privilege escalation scenario where an attacker can influence the creation of Elasticsearch ingest pipelines, effectively bypassing the caller's authorized Elasticsearch permissions.\nThe vulnerability affects the Kibana product, specifically within its integration management components.\nThe risk implication is significant, as it permits unauthorized administrative actions on the Elasticsearch backend by abusing legitimate Fleet management access.\nSuccessful exploitation requires the attacker to possess existing Fleet management privileges, meaning the attack vector is restricted to authenticated, albeit over-privileged, users.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization and validation of configuration fields provided to the Kibana Cribl integration module. The system takes user-supplied input from specific configuration fields and passes them into a server-side script template without adequate neutralisation of special characters or expression delimiters.\nThe exploitation flow begins when an attacker, already authenticated and possessing Fleet management privileges, interacts with the Kibana user interface to modify Cribl integration settings. During this interaction, the attacker embeds malicious expression syntax into one of the vulnerable configuration fields. Because the server-side template engine executes this template during processing, the injected expression is evaluated within the context of the Kibana server.\nThe script template acts as an intermediary, constructing definitions for Elasticsearch ingest pipelines based on the provided configuration. By injecting malicious expressions, the attacker manipulates the output generated by this template. This effectively allows the attacker to craft ingest pipeline configurations that contain unauthorized instructions or directives that the Kibana service then attempts to apply to the Elasticsearch cluster.\nCrucially, the Kibana service applies these crafted pipelines using its own elevated credentials, which may be higher than the limited permissions assigned to the user performing the integration configuration. This results in the writing of ingest pipelines beyond the caller’s authorized scope, potentially allowing the attacker to intercept, modify, or drop ingested data, or to execute other secondary functions supported by the Elasticsearch ingest pipeline framework.\nThis vulnerability highlights a flaw in the trust boundary between user-configurable parameters and the server-side script execution engine. Because the template engine is permitted to execute logic based on unsanitized input, it enables an attacker to perform unauthorized side effects on backend infrastructure. The attack is contained within the Kibana server environment, but the impact propagates to the underlying Elasticsearch cluster, demonstrating a breach of access control through secondary privilege escalation."
}