Kibana Hit by High-Severity Flaw Allowing Remote Code Execution
Elastic has revealed a high-impact security flaw in Kibana, its widely-used visualization and analytics interface. The bug could let attackers run arbitrary code on affected systems under certain configurations.
Cataloged as CVE-2025-25014, the flaw spans several Kibana versions and has been rated critical with a CVSS score of 9.1. Its potential reach is vast due to Kibana’s widespread use in enterprise data pipelines and observability stacks.
Underlying Issue: Prototype Pollution
Announced via Elastic’s May 6 advisory, the root of the issue lies in a prototype pollution vulnerability. This class of bug exploits JavaScript’s prototype chain behavior, allowing threat actors to tamper with object structures and hijack application logic.
In this case, the vulnerability resides in Kibana’s Machine Learning and Reporting modules. By sending maliciously crafted HTTP requests, attackers may be able to trigger unauthorized code execution within the application.
Elastic notes that the vulnerability applies to Kibana versions 8.3.0 through 8.17.5, 8.18.0, and the recently released 9.0.0. Both self-managed deployments and those running on Elastic Cloud are susceptible—but only when both ML and Reporting features are enabled.
While Elastic Cloud users benefit from additional containment via AppArmor and seccomp-bpf sandboxing, the code execution still occurs inside the Kibana container, posing operational risks.
Why This Matters
Security analysts stress that Kibana often has access to mission-critical telemetry and operational data. A compromise could expose sensitive infrastructure insights or enable deeper pivoting within enterprise environments.
The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that successful exploitation requires high-level privileges but can lead to substantial breaches in confidentiality, integrity, and availability.
Organizations relying on Kibana are urged to assess their deployments, disable vulnerable components if unused, and apply available patches without delay.
Risk Overview
| Category | Description |
|---|---|
| Impacted Versions | Kibana 8.3.0 through 8.17.5, 8.18.0, and 9.0.0 |
| Security Impact | Enables remote code execution through JavaScript prototype pollution |
| Exploitation Conditions | Requires both Machine Learning and Reporting features to be active; attacker must have elevated privileges |
| Severity Rating | CVSS v3.1: 9.1 / 10 (Critical) |
Remediation Steps and Temporary Safeguards
Elastic urges all Kibana users to promptly migrate to the fixed releases—8.17.6, 8.18.1, or 9.0.1—to eliminate exposure to this critical vulnerability.
For organizations that cannot upgrade immediately due to operational constraints, Elastic offers interim protection measures.
Specifically, disabling either the Machine Learning or Reporting feature effectively neutralizes the exploit path. To turn off Machine Learning, administrators should modify the kibana.yml file by inserting the following configuration line:
yaml
xpack.ml.enabled: false
This workaround serves as a stopgap and should be used only until systems can be brought up to date with the secure versions.
As another option, administrators running self-managed Kibana deployments can selectively turn off the anomaly detection capability without disabling the entire Machine Learning suite. This can be done by adding the following directive to the kibana.yml configuration file:
For teams choosing to maintain Machine Learning functionality, the Reporting component can be turned off by applying the following configuration:
According to Elastic team member Paul, disabling either Machine Learning or Reporting is enough to block potential exploitation of the flaw.
This latest issue emerges just two months after Elastic patched another severe prototype pollution vulnerability—CVE-2025-25015, disclosed in March—which carried an even higher CVSS score of 9.9 and impacted Kibana versions 8.15.0 through 8.17.2.
Given Kibana’s critical role in infrastructure observability, organizations are strongly encouraged to review their environments for exposure, apply the latest updates without delay, and implement network segmentation or access controls to limit who can interact with their Kibana instances.
