CVE-2026-78601 — Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure

CVE-2026-78601

Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure PUBLISHED

Description (CNA)

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 9.4.0 through 9.4.4

CWE

CWE-862

References

https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-147/390107

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.