CVE-2026-63141: Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions
Published Jul 21, 2026
·Updated
Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.
Affected Software
3 affected components
Elastic Kibana
Elastic Kibana>=9.3.0<9.3.8
Elastic Kibana>=9.4.0<9.4.4
Event History
Jul 21, 2026
CVE Published
via MITRE·09:08 PM
Data Sourced
via MITRE·09:08 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:19 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-63141?
CVE-2026-63141 has a medium severity rating of 6.3.
2
How do I fix CVE-2026-63141?
To fix CVE-2026-63141, ensure that appropriate authorization checks are implemented for accessing Cloud Connect management functions in Kibana.
3
What kind of access does CVE-2026-63141 allow?
CVE-2026-63141 allows an authenticated user to access and modify Cloud Connect configuration and service settings without proper feature privileges.
4
Which software is affected by CVE-2026-63141?
CVE-2026-63141 affects Elastic Kibana.
5
When was CVE-2026-63141 published?
CVE-2026-63141 was published on July 21, 2026.