CVE-2026-63138: Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure
Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic, returning data the user is not authorized to read.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated Kibana user and must have access to the affected query functionality. Exploitation does not require user interaction.
What is the impact of successful exploitation?
A successful attacker can alter the intended query logic with specially crafted input and retrieve data they are not authorized to read. The reported impact is confidentiality loss; integrity and availability are not affected.
Is this exploitable remotely?
Yes. The vector is network-based, so an authenticated user who can reach the affected Kibana query functionality may be able to exploit it.