CVE-2026-78608

Undergoing Analysis Undergoing Analysis - In Progress

Missing Authorization in Kibana Leads to Information Disclosure

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-78608

EUVD

EUVD-2026-69569

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	8.19
elastic	kibana	9.4
elastic	kibana	7.17
elastic	kibana	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Authorization issue in Kibana (CWE-862) that allows any authenticated user to read APM server credentials without proper administrative privileges. It occurs due to an authorization control not being applied to an internal Kibana APM integration function.

Detection Guidance

To detect this vulnerability, check if your Kibana version is affected by verifying the installed version against the patched releases (8.19.21, 9.4.6, 9.5.2). Use commands like 'curl -XGET http://localhost:5601/api/status' to inspect version details. Ensure no unauthorized users have accessed APM server credentials.

Impact Analysis

An attacker with authenticated access to Kibana could exploit this to read sensitive APM server credentials, potentially leading to unauthorized access to APM data or further attacks on connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) by exposing credentials and allowing access to protected information.

Mitigation Strategies

Immediately upgrade Kibana to the latest patched versions (8.19.21, 9.4.6, or 9.5.2). After upgrading, rotate all APM secret tokens to invalidate any potentially exposed credentials. Ensure only authorized users have access to APM or Fleet administrative privileges.

Hi! I’m here to help you understand CVE-2026-78608. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70