Description
Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | kibana | 4.1.11-1.el7 | RHSA-2016:1836 |
| Red Hat OpenShift 3 | openshift-elasticsearch-plugin | 0.16.0.redhat_1-1.el7 | RHSA-2016:1836 |
Advisories 1
- RHSA-2016:1836 Red Hat Security Advisory: Red Hat OpenShift Enterprise Kibana security update Red Hat Security Advisories (RHSA) · May 13, 2026