CVE-2026-78593 — Improper Control of Generation of Code in Kibana Leading to Privilege Escalation

CVE-2026-78593

Improper Control of Generation of Code in Kibana Leading to Privilege Escalation PUBLISHED

Description (CNA)

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 8.0.0 through 8.19.20; affected 9.0.0 through 9.4.5; affected 9.5.0 through 9.5.2

CWE

CWE-94

References

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.