This vulnerability (CWE-639) in Kibana 9.1.0 permits an attacker with limited privileges in one Kibana space to bypass authorization controls and execute Osquery live queries on Elastic Agents in other spaces to which they have no access. The flaw is due to user-controlled keys not being properly constrained by ACLs, enabling unauthorized query execution and data disclosure. The CVSS 3.1 base score is 6.8, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability. No patch or official remediation level has been published yet.

An attacker authorized to run Osquery live queries in one Kibana space can execute queries on hosts in other spaces without authorization, resulting in unauthorized disclosure of sensitive information from those hosts. This compromises confidentiality and integrity of data accessible through Osquery results. There is no indication of impact on system availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Osquery live query permissions to trusted users only and monitor for unusual query activity across Kibana spaces. Avoid granting Osquery query privileges broadly. Follow vendor updates closely for patches or official mitigations.