Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection… (CVE-2026-63138)

This vulnerability (CWE-943) in Kibana allows an authenticated user with query access to submit specially crafted input that manipulates NoSQL query logic, resulting in unauthorized data disclosure. The flaw stems from improper neutralization of special elements in the query input, enabling NoSQL injection attacks (CAPEC-676). The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or vendor advisory details are available to confirm remediation status.

An authenticated user with access to the vulnerable query functionality can exploit this flaw to retrieve data they are not authorized to access, resulting in information disclosure. There is no reported impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected query functionality to trusted users only and monitor for suspicious query activity.