Kibana CrowdStrike Connector Flaw Exposes Sensitive Credentials

A security issue in the Kibana CrowdStrike Connector allows attackers to access stored CrowdStrike credentials, with the flaw tracked as CVE-2025-37728. The vulnerability arises from insufficient protection of credentials in the CrowdStrike Connector, and when a connector is created in one workspace, the credentials used to access the CrowdStrike API are cached, enabling a malicious user with access to another space to retrieve them.

Elastic has released patched versions to resolve the issue and urges users to upgrade immediately; the risk is described as a medium severity with a CVSSv3.1 score of 5.4. According to Elastic, the affected versions include 7.x up to 9.1.x, and upgrades to 8.18.8, 8.19.5, 9.0.8, or 9.1.5 are necessary. After upgrading, administrators should review connector configurations and rotate any potentially exposed credentials, as there is no workaround or temporary mitigation available.