CVE-2026-82298
Received Received - Intake

Incorrect Authorization in Kibana Leads to DoS

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Elastic

Description
Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-82298
EUVD
EUVD-2026-70661

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elastic kibana *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Authorization issue (CWE-863) in Kibana that allows denial of service through exploiting incorrectly configured access control security levels (CAPEC-180).

Detection Guidance

To detect CVE-2026-82298, check if your Kibana instance is running a vulnerable version (8.19.20 or earlier, 9.4.5 or earlier, or 9.5.2 or earlier). Use commands like 'curl -X GET http://localhost:5601/api/status' to verify the version. If the version is vulnerable, upgrade to 8.19.21, 9.4.6, or 9.5.3.

Impact Analysis

It can lead to denial of service, disrupting Kibana services and preventing legitimate users from accessing the system.

Compliance Impact

The vulnerability (CVE-2026-82298) involves incorrect authorization leading to denial of service via misconfigured access controls. This could potentially impact compliance with standards like GDPR or HIPAA by disrupting data availability or integrity if exploited. However, the provided context does not specify direct compliance implications or violations.

Mitigation Strategies

Update Kibana to the latest patched version to address the Incorrect Authorization vulnerability. Review and correct access control security levels to prevent unauthorized access attempts that could lead to denial of service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82298. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart