Report feedback

An authenticated remote attacker can, due to a prototype pollution vulnerability on Kibana instances (self-hosted and Elastic Cloud) with the Machine Learning (ML) and Reporting features enabled, execute code by sending specially crafted HTTP requests to the ML and Reporting endpoints. If an immediate update to a fixed version is not possible, it is recommended to disable one of these features as a temporary risk mitigation. Detailed information on the mitigation can be found at [1].

The vulnerability is present in product:

• *:Kibana; >=8.3.0, <=8.17.5; ==8.18.0; ==9.0.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2025-25014 at cve.org, NVD
• CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') at cwe.mitre.org

The vulnerability was publicly disclosed 6. 5. 2025.

An unauthenticated remote attacker can, due to incorrect certificate validation in the TCP output plugin on Logstash instances (self-hosted and Elastic Cloud), carry out a man-in-the-middle (MITM) attack when running in "client" mode with the configuration "ssl_verification_mode => full". If an immediate update of Logstash to a fixed version is not possible, the TCP output plugin can be updated to version 6.2.2 or 7.0.1 as a temporary mitigation using the command "bin/logstash-plugin update logstash-output-tcp" [2].

The vulnerability is present in product:

• *:Kibana; <8.17.6; ==8.18.0; ==9.0.0;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

More information:

• CVE-2025-37730 at cve.org, NVD
• CWE-295: Improper Certificate Validation at cwe.mitre.org

The vulnerability was publicly disclosed 6. 5. 2025.