CVE-2026-26939 — Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration

CVE-2026-26939

Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration PUBLISHED

Description (CNA)

Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 9.0.0 through 9.2.5; affected 9.3.0 through 9.3.0; affected 8.0.0 through 8.19.11

CWE

CWE-862

References

https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-19/385530

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.