CVE-2026-26939
Missing Authorization in Kibana Detection Rules Enables Unauthorized Actions
Publication date: 2026-03-19
Last updated on: 2026-03-23
Assigner: Elastic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elastic | kibana | 9.3.0 |
| elastic | kibana | From 8.0.0 (inc) to 8.19.12 (exc) |
| elastic | kibana | From 9.0.0 (inc) to 9.2.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-26939 is a security vulnerability in Kibana's server-side Detection Rule Management component. It is caused by missing authorization controls (CWE-862), which allows an authenticated attacker with rule management privileges to perform unauthorized endpoint response action configurations such as host isolation, process termination, and process suspension."}, {'type': 'paragraph', 'content': 'The vulnerability exploits improper access control (CAPEC-1), enabling users without explicit Elastic Defend feature privileges to bypass restrictions and add response actions to detection rules. This issue specifically affects the Update API when adding response actions to rules that previously had none.'}, {'type': 'paragraph', 'content': 'Automated response actions require an appropriate Elastic Stack subscription or Serverless project feature tier and Elastic Agent with Elastic Defend integration installed on hosts. These actions are not enabled by default and must be explicitly configured by users.'}] [1]
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker with rule management privileges to configure unauthorized endpoint response actions such as isolating hosts, terminating processes, or suspending processes on affected systems.
Such unauthorized actions can compromise the integrity of your systems by disrupting normal operations or interfering with processes, potentially leading to operational issues or misuse of endpoint controls.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability on your system, you should audit detection rules for unauthorized response_action configurations involving endpoint actions such as isolate, kill-process, and suspend-process.
Specifically, focus on rules that previously had no response actions but now have them added, as the vulnerability affects the Update API when adding response actions to such rules.
It is recommended to restrict detection rule management privileges to only authorized users and review the configurations for any unauthorized changes.
The resource does not provide explicit commands, but auditing detection rules and their response_action fields in Kibana or via the Elastic Stack APIs would be the approach.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade Kibana to the fixed versions: 8.19.12, 9.2.6, or 9.3.1.
If immediate upgrade is not possible, restrict detection rule management privileges to only those users authorized to configure endpoint response actions.
Additionally, audit detection rules for unauthorized response_action configurations involving endpoint actions such as host isolation, process termination, and process suspension.
Note that automated response actions require an appropriate Elastic Stack subscription or Serverless project feature tier and Elastic Agent with Elastic Defend integration installed on hosts; these actions are not enabled by default.