CVE-2026-78603

Undergoing Analysis Undergoing Analysis - In Progress

Missing Authorization in Kibana Leads to Information Disclosure

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-78603

EUVD

EUVD-2026-69571

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.0.0 (inc) to 9.4.5 (inc)
elastic	kibana	9.5.0
elastic	kibana	9.4.6
elastic	kibana	9.5.1
elastic	kibana	From 7.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-78603 is a missing authorization vulnerability in Kibana versions 9.0.0 through 9.4.5 and 9.5.0. It allows authenticated users with minimal Elasticsearch privileges to bypass Kibana's feature authorization and space access controls. This can lead to unauthorized disclosure of Fleet deployment metadata from the default Kibana space.

Detection Guidance

To detect this vulnerability, check if your Kibana instance is running a vulnerable version (9.0.0 through 9.4.5 or 9.5.0). Use the command: curl -X GET "http://localhost:5601/api/status" to verify the version. If the version is within the affected range, the system is vulnerable.

Impact Analysis

An attacker with minimal privileges could access sensitive Fleet deployment metadata from the default Kibana space. This could expose configuration details or other sensitive information about your infrastructure.

Compliance Impact

The vulnerability allows unauthorized disclosure of Fleet deployment metadata, which could include sensitive information. This may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., exposure of protected health information). Organizations must assess whether this breach of access controls impacts their compliance posture.

Mitigation Strategies

Upgrade Kibana to version 9.4.6, 9.5.1, or later immediately. If upgrading is not possible, consider disabling Fleet policies in the default space or restricting access to Kibana features until an upgrade is completed.

Hi! I’m here to help you understand CVE-2026-78603. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70