CVE-2025-25014

The attacker sends crafted HTTP requests to machine learning or reporting endpoints in Kibana. These requests contain a payload exploiting the prototype pollution mechanism (CWE-1321), which involves modifying JavaScript object prototypes in such a way that properties added to the base object are inherited by all other objects in the application. This enables the attacker to take control of the application logic and consequently execute arbitrary code on the server side.

An attacker with administrative privileges can execute arbitrary code on the server hosting Kibana, leading to complete compromise of the instance, data exfiltration, and potential lateral movement within the infrastructure.

Kibana should be updated to version 8.17.6, 8.18.1, or 9.0.1 in accordance with the vendor's security advisory ESA-2025-07. Until the patch is deployed, it is recommended to restrict access to machine learning and reporting endpoints only to trusted users and networks.

Elastic Kibana — versions indicated in vendor references; according to the references, patches were released in versions 8.17.6, 8.18.1, and 9.0.1, suggesting the vulnerability affects earlier releases of these branches