CVE-2025-68387: 
Kibana vulnerability analysis and mitigation

CVE-2025-68387 is a stored Cross-Site Scripting (XSS) vulnerability in Elastic Kibana affecting the Vega AST evaluator's function handler. It allows unauthenticated attackers to embed malicious scripts into web content served to users' browsers. The vulnerability was disclosed on December 18, 2025, and affects Kibana versions 7.0.0–7.17.29, 8.0.0–8.19.8, 9.0.0–9.1.8, and 9.2.0–9.2.2. It carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Elastic Advisory).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically within a function handler in Kibana's Vega Abstract Syntax Tree (AST) evaluator. Vega is a visualization grammar used in Kibana dashboards; the AST evaluator processes Vega specifications and, due to insufficient input sanitization, allows injection of arbitrary JavaScript. An unauthenticated attacker can craft a malicious Vega specification containing embedded script content that, when rendered in a victim's browser, executes in the context of the Kibana application (CAPEC-63). No authentication or special privileges are required to craft the malicious payload, though user interaction (a victim visiting or viewing the affected content) is necessary for execution (Red Hat Bugzilla, Elastic Advisory).

Successful exploitation results in arbitrary JavaScript execution within the victim's browser in the context of the Kibana application, with a changed scope (cross-domain impact). This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and exfiltration of sensitive data accessible within Kibana (e.g., Elasticsearch data, dashboards, and configurations). Confidentiality and integrity are both assessed as low impact per the CVSS scoring, with no direct availability impact; however, chained with other vulnerabilities or privileged user sessions, the risk could be significantly elevated (Red Hat Advisory, Elastic Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.074%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been identified (Red Hat Advisory).

1. Reconnaissance: Identify publicly accessible Kibana instances running affected versions (7.0.0–7.17.29, 8.0.0–8.19.8, 9.0.0–9.1.8, or 9.2.0–9.2.2) using tools like Shodan or Censys, searching for Kibana login pages or version banners.
2. Craft malicious Vega specification: Create a Vega or Vega-Lite visualization specification that embeds a malicious JavaScript payload within a function handler field processed by the Kibana Vega AST evaluator (e.g., within a signal expression or event handler that bypasses input sanitization).
3. Inject payload: Save or share the malicious Vega visualization as a Kibana dashboard panel. Since no authentication is required to craft the payload, an attacker may leverage any available mechanism to introduce the malicious specification into a shared or public dashboard.
4. Deliver to victim: Trick an authenticated Kibana user (e.g., an administrator) into viewing the dashboard containing the malicious visualization, via phishing, shared links, or embedding in a shared space.
5. Execute and exfiltrate: The victim's browser executes the injected script in the Kibana application context, enabling the attacker to steal session cookies, capture credentials, perform actions on behalf of the victim, or exfiltrate data accessible within Kibana (Red Hat Bugzilla, Elastic Advisory).

• Network: Unexpected outbound HTTP requests from a user's browser to external domains shortly after loading a Kibana dashboard; unusual POST requests to attacker-controlled endpoints containing encoded session tokens or cookie data.
• Logs: Kibana access logs showing requests to dashboard or visualization endpoints containing unusual or encoded Vega specification content; browser console errors related to script execution in Vega/Vega-Lite panels.
• File System: Unexpected or newly created Kibana saved objects (dashboards, visualizations) containing Vega specifications with obfuscated or encoded JavaScript in function handler fields.
• Process/Application: Kibana audit logs recording creation or modification of Vega visualizations by unknown or unauthenticated users; anomalous saved object API calls creating or updating Vega-type visualizations.

Elastic has released patched versions addressing this vulnerability: Kibana 8.19.9, 9.1.9, and 9.2.3. Users running Kibana 7.x (7.0.0–7.17.29) should review Elastic's advisory for guidance, as this branch may not receive a patch. Organizations should upgrade to the fixed versions as the primary remediation. As a temporary workaround, restricting access to Kibana dashboard creation and Vega visualization features to trusted, authenticated users can reduce exposure (Elastic Advisory, Red Hat Advisory).

Red Hat tracked the vulnerability via their security response process and assigned it medium severity, consistent with the CVSS 6.1 score. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage. The NetEye blog published a security advisory referencing the Elastic Stack vulnerability in January 2026 (NetEye Blog).