CVE-2026-63262 Missing Authorization in Kibana Leading to Information Disclosure

What is CVE-2026-63262?

CVE-2026-63262 is a medium-severity missing authorization vulnerability in Elastic Kibana, published on 21 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

Weakness: CWE-862

Which versions are affected by CVE-2026-63262?

2 open source packages ship an affected version, including kibana and elk. It affects 1 product.

Products include Elastic Kibana.

How do I fix CVE-2026-63262?

Upgrade kibana to 9.4.4 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-63262 being exploited?

There is no known exploitation of CVE-2026-63262 in the wild and no public exploit code.

Other vulnerabilities in Elastic Kibana

• CVE-2019-7609 Kibana Arbitrary Code Execution Exploited Critical 9.8
• CVE-2025-25015 Kibana arbitrary code execution via prototype pollution Critical 9.9
• CVE-2024-37288 Deserialization in Kibana Critical 9.9
• CVE-2023-31415 Code injection in Kibana Critical 9.9
• CVE-2018-17245 Information disclosure in Kibana Critical 9.8

All Elastic Kibana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-elk-2026-63262, BIT-kibana-2026-63262, GHSA-9pm3-74f7-q229, MINI-qxc6-f4r6-hhjw.