CVE-2026-63138

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An authenticated user with access to the query functionality can perform a NoSQL Injection, which occurs when an application fails to properly sanitize input used in a database query. By submitting specially crafted input, an attacker can alter the intended query logic to disclose information that they are not authorized to read.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.