CVE-2025-68422: 
Kibana vulnerability analysis and mitigation

CVE-2025-68422 is an Improper Authorization vulnerability (CWE-863) in Elastic Kibana that allows an authenticated user to bypass intended permission restrictions via a crafted HTTP request, enabling privilege escalation (CAPEC-233). Specifically, an attacker lacking the 'live queries - read' permission can successfully retrieve the list of live queries. Affected versions include Kibana 7.0.0–7.17.29, 8.0.0–8.19.6, 9.0.0–9.1.6, and 9.2.0. The vulnerability was disclosed on December 18, 2025, with patches released the same day. It carries a CVSS v3.1 base score of 4.3 (Medium) (Elastic Advisory, Red Hat Bugzilla).

The root cause is Incorrect Authorization (CWE-863), where Kibana fails to properly enforce permission checks on the API endpoint responsible for listing live queries. An authenticated attacker can craft a specific HTTP request that bypasses the 'live queries - read' permission gate, allowing unauthorized access to query data. The attack requires only low-level authenticated access (any valid Kibana user account), no user interaction, and is exploitable over the network with low complexity. No public proof-of-concept code has been identified at this time (Elastic Advisory, Red Hat Bugzilla).

Successful exploitation results in unauthorized disclosure of live query data to authenticated users who should not have access to it, representing a confidentiality impact. There is no integrity or availability impact — the vulnerability is limited to information disclosure within the scope of the affected Kibana instance. In environments where live queries contain sensitive operational or security data (e.g., endpoint detection queries), exposure could aid an attacker in understanding the monitoring posture and evading detection (Elastic Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-68422. The EPSS score is approximately 0.026%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session, limiting the attack surface to users with at least some level of Kibana access (Elastic Advisory).

1. Obtain authenticated access: Acquire any valid Kibana user account credentials — even a low-privileged account without the 'live queries - read' permission is sufficient.
2. Identify the live queries API endpoint: Locate the Kibana API endpoint used to list live queries (part of the Osquery/Fleet integration feature set).
3. Craft a malicious HTTP request: Construct an HTTP request to the live queries listing endpoint that bypasses the authorization check, potentially by manipulating request headers, parameters, or the request structure in a way that circumvents the permission enforcement logic.
4. Send the request: Submit the crafted request to the target Kibana instance while authenticated.
5. Retrieve live query data: The server responds with the list of live queries despite the user lacking the required 'live queries - read' permission, exposing potentially sensitive query configurations (Elastic Advisory).

• Logs: Kibana access logs showing authenticated requests to live query listing API endpoints from users or roles that do not have the 'live queries - read' permission assigned.
• Logs: Unexpected HTTP 200 responses to live query API calls from low-privileged user accounts that should receive 403 Forbidden responses.
• Network: Repeated or scripted API calls to Kibana's live queries endpoint from a single authenticated session, particularly outside normal business hours.

Elastic has released patched versions addressing this vulnerability: Kibana 8.19.7, 9.1.7, and 9.2.1. Users running Kibana 7.x (7.0.0–7.17.29) should upgrade to a supported 8.x or 9.x release, as no patch is available for the 7.x branch. No configuration-based workaround has been published; upgrading to a fixed version is the recommended remediation. Organizations should prioritize upgrading instances where Kibana is accessible to users with varying permission levels (Elastic Advisory).

Elastic published the security advisory (ESA-2025-39) on December 18, 2025, alongside the patched releases. Red Hat tracked the issue via Bugzilla as a medium-severity vulnerability. No significant independent researcher commentary, social media discussion, or major media coverage has been identified for this vulnerability, consistent with its moderate CVSS score and limited exploitation potential (Elastic Advisory, Red Hat Bugzilla).