CVE-2026-78595 — Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure

CVE-2026-78595

Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure PUBLISHED

Description (CNA)

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 9.1.0 through 9.4.5; affected 9.5.0 through 9.5.2

CWE

CWE-862

References

https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.