CVE-2024-37279: Kibana Broken Access Control issue

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-13 · updated 2026-06-17
Weakness: CWE-284

Description

A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.

Affected products

Kibana: from 8.6.3 before 8.14.0 — fixed in 8.14.0

How to fix

Upgrade to a fixed version: Kibana 8.14.0. Check the vendor advisory for mitigations.

References

https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887
https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887

Get alerted when CVE-2024-37279 or the next vulnerability affects your stack