CVE-2025-25014

CRITICAL

Kibana 8.3.0-8.17.5 - Prototype Pollution via Machine Learning and Reporting Endpoints

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-25014. PoCs published by davidxbors.

AI-analyzed exploit summary This PoC is a detection script for CVE-2025-25014, a prototype pollution vulnerability in Kibana. It checks for vulnerability by sending a crafted HTTP request to the target Kibana instance and verifying the response.

Description

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

Exploits (1)

nomisec SCANNER 1 stars
by davidxbors · poc
https://github.com/davidxbors/CVE-2025-25014

This PoC is a detection script for CVE-2025-25014, a prototype pollution vulnerability in Kibana. It checks for vulnerability by sending a crafted HTTP request to the target Kibana instance and verifying the response.

Classification
Scanner 90%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: Kibana (version not specified)
Auth required
Prerequisites: Valid credentials for Kibana authentication · Network access to the target Kibana instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 9.1
EPSS 0.1292
EPSS Percentile 95.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-1321
Status published
Products (3)
elastic/kibana 8.18.0
elastic/kibana 9.0.0
elastic/kibana 8.3.0 - 8.17.6
Published May 06, 2025
Tracked Since Feb 18, 2026