CVE-2026-78584

Analyzed Analyzed - Analysis Complete

Observable Response Discrepancy in Kibana Osquery Feature

Publication date: 2026-09-02

Last updated on: 2026-09-03

Assigner: Elastic

Description

Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-02

Last Modified

2026-09-03

Generated

2026-09-13

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-12

NVD

CVE-2026-78584

EUVD

EUVD-2026-70063

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.4.0 (inc) to 9.4.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This is a medium-severity vulnerability in Kibana versions 9.4.0 through 9.4.3. It involves an observable response discrepancy in the Osquery feature that allows authenticated users with live-query privileges to check if a scheduled query identifier exists in a Kibana space they are not authorized to access. This could lead to cross-space information disclosure.

Detection Guidance

To detect this vulnerability, check if your Kibana version is between 9.4.0 and 9.4.3. Run: curl -X GET "http://<kibana-host>:<port>/api/status" | grep version. If the version is in this range, the system is vulnerable.

Impact Analysis

An attacker with authenticated access and Osquery privileges could determine the existence of restricted scheduled queries in unauthorized spaces. This may expose information about system configurations or operations without direct access to the data.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized information disclosure. An authenticated attacker could determine the existence of restricted scheduled query identifiers in unauthorized Kibana spaces, which may lead to unauthorized data exposure. This violates principles of least privilege and data confidentiality required by these regulations.

Mitigation Strategies

Upgrade Kibana to version 9.4.4 or later immediately. There are no workarounds for users unable to upgrade. Verify the upgrade by checking the version again using the same command.

Hi! I’m here to help you understand CVE-2026-78584. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70