CVE-2026-78584
Received Received - Intake

Observable Response Discrepancy in Kibana Osquery Feature

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Elastic

Description
Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-78584
EUVD
EUVD-2026-70063

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
elastic kibana *
elastic kibana From 9.4.0 (inc) to 9.4.3 (inc)
elastic kibana 9.4.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a medium-severity vulnerability in Kibana versions 9.4.0 through 9.4.3. It involves an observable response discrepancy in the Osquery feature that allows authenticated users with live-query privileges to check if a scheduled query identifier exists in a Kibana space they are not authorized to access. This could lead to cross-space information disclosure.

Detection Guidance

To detect this vulnerability, check if your Kibana version is between 9.4.0 and 9.4.3. Run: curl -X GET "http://<kibana-host>:<port>/api/status" | grep version. If the version is in this range, the system is vulnerable.

Impact Analysis

An attacker with authenticated access and Osquery privileges could determine the existence of restricted scheduled queries in unauthorized spaces. This may expose information about system configurations or operations without direct access to the data.

Mitigation Strategies

Upgrade Kibana to version 9.4.4 or later immediately. There are no workarounds for users unable to upgrade. Verify the upgrade by checking the version again using the same command.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78584. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart