A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
Date: 2025-05
Affected: elastic/kibana
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-25014
CWE: CWE-1321
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.


Mitigations:

Architectural layers (MAESTRO):