CVE-2024-12556: High Prototype Pollution in Elastic Kibana

CVE-2024-12556 is a high severity (CVSS 8.7) prototype pollution flaw in Elastic Kibana that can lead to code injection through unrestricted file upload combined with path traversal. Elastic says affected versions are 8.16.1 to 8.16.3 and 8.17.0 to 8.17.1. Upgrade to 8.16.4, 8.17.2 or later.

What's affected

• Kibana 8.16.1 up to and including 8.16.3.
• Kibana 8.17.0 up to and including 8.17.1.
• Elastic updated its advisory on 5 June 2025 to clarify that 8.16.4 is not affected.

Elastic advises upgrading to 8.16.4 and 8.17.2 or higher (advisory ESA-2025-02).

How to check if you're exposed

Run the check below, or read the vendor or project notes linked in Sources.

bin/kibana --version
# then check whether the integration assistant is enabled
grep -n integration_assistant config/kibana.yml

Compare the result to the affected range above.

What to do now

1. Upgrade Kibana to 8.16.4, 8.17.2 or any later release, following Elastic's upgrade guide.
2. If you cannot upgrade yet, set xpack.integration_assistant.enabled: false in kibana.yml, as Elastic recommends, then restart Kibana.
3. Limit who holds Kibana accounts with write privileges. The vector requires low privileges and user interaction.
4. Check your other Kibana instances. Dev and staging copies are easy to forget.
5. Look up CVE-2024-12556 on its Gold page to see the current details and any fix information.
6. Check your own dependency files with the free in-browser dependency scan. It runs in your browser and does not send the file to a server.

Why it matters

Elastic describes the flaw as prototype pollution that leads to code injection through an unrestricted file upload combined with path traversal. Three weaknesses chain together, which is why a single mitigation is hard to find short of upgrading.

The scope changed rating in the vector means a successful attack can affect resources beyond Kibana itself. The mitigation Elastic gives, turning off the integration assistant, tells you where the vulnerable path lives. Treat it as a stopgap rather than a replacement for the upgrade.

This CVE is a prototype pollution flaw (CWE-1321, Prototype Pollution). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.

Prototype pollution is a JavaScript weakness. Objects inherit properties from a shared prototype, and if attacker input can write to it, every object in the process may change behavior.

On its own that can be a nuisance. Combined with a file upload that has weak path checks, Elastic says it leads to code injection. The fix pattern is to reject keys such as proto when merging user data, to use maps for untrusted keys, and to keep upload paths inside a fixed folder.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Elastic security advisory ESA-2025-02

Last reviewed: 19 October 2026.