CVE-2026-78597
Awaiting Analysis Awaiting Analysis - Queue

Missing Authorization in Kibana Entity Store

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description
Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-78597
EUVD
EUVD-2026-69574

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
elastic kibana to 8.19.21 (exc)
elastic kibana to 9.4.6 (exc)
elastic kibana *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78597 is a missing authorization vulnerability in Kibana's Entity Store feature. It allows authenticated users with low-privilege security access to create and persist Elasticsearch API keys under their identity, bypassing required elevated privileges. This occurs due to improperly constrained functionality, enabling unauthorized credential creation despite lacking proper permissions.

Detection Guidance

To detect this vulnerability, check if your Kibana instance is running a vulnerable version (8.19.20 or earlier, or 9.4.5 or earlier). Run: 'curl -X GET "http://localhost:5601/api/status" | grep version' to check the version. If the Entity Store feature is enabled, verify if unauthorized API keys are being created by reviewing Elasticsearch API key logs for unexpected key generation under low-privilege users.

Impact Analysis

An attacker with low privileges could create API keys under their identity, potentially gaining unauthorized access to Elasticsearch resources. This could lead to data exposure or manipulation, though the CVSS score of 4.3 suggests limited impact. The vulnerability affects Kibana versions 8.19.20 and earlier (8.x) and 9.4.5 and earlier (9.x).

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements like GDPR or HIPAA. Unauthorized credential creation may result in data breaches, which could lead to regulatory penalties or legal consequences depending on the affected data.

Mitigation Strategies

Upgrade Kibana to version 8.19.21 or later (8.x series) or 9.4.6 or later (9.x series). If using Elastic Cloud Serverless, no action is needed as it was patched before disclosure. Disable the Entity Store feature if not required, as it is the root cause of this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78597. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart