CVE-2026-78601
Received Received - Intake

Missing Authorization in Kibana Leads to Information Disclosure

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Elastic

Description
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-78601
EUVD
EUVD-2026-70054

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
elastic kibana *
elastic kibana From 9.4.0 (inc) to 9.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78601 is a Missing Authorization vulnerability in Kibana where an authenticated user with elevated privileges can exploit a missing authorization control in the Entity Store configuration. This allows them to indirectly read from Elasticsearch indices they are not authorized to access, exposing derived entity data through the entity store output.

Detection Guidance

To detect this vulnerability, check if your Kibana instance is running version 9.4.0 through 9.4.4 with Entity Store v2 enabled. Verify if the feature was installed at least once. Use commands like 'curl -XGET http://localhost:5601/api/status' to check Kibana version and 'curl -XGET http://localhost:5601/api/entity_store/status' to confirm Entity Store v2 status.

Impact Analysis

This vulnerability could lead to unauthorized exposure of sensitive data stored in Elasticsearch indices. An attacker with elevated Kibana privileges might access information they should not be able to view, potentially compromising confidentiality of data.

Compliance Impact

This vulnerability could result in unauthorized data access, which may violate compliance requirements such as GDPR or HIPAA. Unauthorized exposure of sensitive data could lead to regulatory penalties or legal consequences depending on the data involved.

Mitigation Strategies

Upgrade Kibana to version 9.4.5 or later immediately. If upgrading is not possible, disable the Entity Store v2 feature if enabled. Ensure no unauthorized access has occurred by reviewing Elasticsearch index access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart