CVE-2026-63259: 
Kibana vulnerability analysis and mitigation

CVE-2026-63259 is an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) in Elastic Kibana that enables authenticated users to access scheduled query result data from Kibana Spaces they are not authorized to view. It affects Kibana versions 9.4.0 through 9.4.3, and was published on July 21, 2026, with a patch released in version 9.4.4. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Elastic Advisory).

The root cause is an improper authorization check (CWE-639) in Kibana's handling of user-supplied identifiers for scheduled query results. An authenticated attacker can supply a crafted identifier referencing scheduled query result data belonging to a Kibana Space they do not have permission to access, and the application fails to validate whether the requester is authorized for that Space before returning the data. This is a network-accessible attack requiring low privileges and no user interaction, with low attack complexity (GitHub Advisory, Elastic Advisory).

Successful exploitation results in unauthorized information disclosure: any authenticated Kibana user can retrieve scheduled query result data from Kibana Spaces they do not have permission to access by manipulating user-controlled identifiers. There is no impact on integrity or availability. The scope of exposure is limited to scheduled query result data within the affected Kibana instance, but in environments where Spaces are used to enforce data segregation between teams or tenants, this could expose sensitive business or operational data (GitHub Advisory, Elastic Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.186%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid Kibana credentials, limiting the attack surface to authenticated users.

1. Authentication: Obtain valid Kibana credentials for any user account on the target instance running versions 9.4.0–9.4.3.
2. Enumerate Spaces: Identify the names or IDs of Kibana Spaces that exist on the instance, which may be discoverable through the Kibana API or UI.
3. Identify scheduled query identifiers: Enumerate or guess identifiers for scheduled queries (e.g., saved search or query job IDs) associated with Spaces the attacker does not have access to.
4. Craft unauthorized request: Submit an API request referencing a scheduled query result identifier belonging to an unauthorized Space, bypassing the expected authorization check.
5. Retrieve disclosed data: The server returns the scheduled query result data without verifying the requester's Space-level authorization, completing the unauthorized information disclosure (GitHub Advisory, Elastic Advisory).

• Logs: Kibana access logs showing authenticated API requests for scheduled query result identifiers associated with Spaces the requesting user is not a member of; repeated cross-Space query result lookups from a single user account.
• Network: Unusual patterns of API calls to Kibana scheduled query result endpoints from accounts that do not normally access those Spaces.
• Behavioral: A single user account accessing scheduled query results across multiple Kibana Spaces in a short time window, particularly Spaces outside their normal operational scope.

Elastic has released Kibana version 9.4.4 to address this vulnerability; organizations running versions 9.4.0 through 9.4.3 should upgrade immediately (Elastic Advisory). As a compensating control prior to patching, administrators should review and restrict Kibana user permissions to limit access to only necessary Spaces, and monitor access logs for anomalous cross-Space query result retrieval. No alternative workaround has been officially documented by Elastic.

Elastic published a security advisory (ESA-2026-70) alongside the Kibana 9.4.4 release addressing this and potentially other issues (Elastic Advisory). Tenable released a detection plugin (Nessus plugin 330364) for this vulnerability (Tenable). Community and media reaction has been limited given the moderate severity rating and lack of public exploit code.