Kibana 9.3.8/9.4.4 Security Update (CVE-2026-63141): Missing Authorization in Cloud Connect Management

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-65) Vulnerability Overview Vulnerability Name: Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions Vulnerability Description: In Kibana, missing authorization (CVE-862) allows authenticated users to access and modify Cloud Connect configuration and service settings without the required privileges. This is caused by direct requests to product endpoints. Severity: CVSSv3.1: Medium (6.3) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE ID: CVE-2026-63141 Issue Type: CWE-862 - Missing Authorization Impact Scope Affected Versions: - 9.x: - All versions from 9.3.0 to 9.3.7 - All versions from 9.4.0 to 9.4.3 Unaffected Versions: - 8.x versions are not affected. The Cloud Connect feature containing this vulnerability was introduced in 9.3.0 and does not exist in 8.x. - 9.5.x versions are not affected. The fix was included in 9.5.0 and was available prior to public disclosure. Affected Configurations: - Kibana deployments with the Cloud Connect feature enabled and where the administrator has completed Cloud Connect setup. Deployments that do not have Cloud Connect enabled or configured are not affected. Remediation Solution and Mitigation: - The issue is resolved in Kibana 9.3.8 and 9.4.4. Users are advised to upgrade to these versions or later. For Users Unable to Upgrade: - Self-Hosted: Organizations that do not require the Cloud Connect feature can disable it in their Kibana configuration to eliminate the exposure. - Cloud-Hosted: Contact Elastic Support for guidance on disabling the Cloud Connect feature if immediate upgrade is not feasible. Additional Information Indicators of Compromise (IOC): No specific exploitation indicators have been identified. Elastic Cloud Serverless: Due to our continuous deployment and patching model, this vulnerability was already fixed in our Elastic Cloud Serverless products prior to public disclosure.

Goal Reached Thanks to every supporter — we hit 100%!

Kibana 9.3.8/9.4.4 Security Update (CVE-2026-63141): Missing Authorization in Cloud Connect Management