CVE-2026-49092 — Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure

CVE-2026-49092

Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure PUBLISHED

Description (CNA)

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 9.4.0 through 9.4.2

CWE

CWE-863

References

https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-54/388553

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.