CVE-2026-115295

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-115292

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-115293

Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure

Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-115294

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-102406

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package's generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant's data stream through infrastructure under their control. This exposed the affected tenant's subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-102410

Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-102412

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure

Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersonation of trusted Fleet infrastructure components in deployments where those keys are actively used.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-94400

Uncontrolled Resource Consumption in Kibana Leading to denial of service

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72668

Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78582

Missing Authorization in Kibana Leading to Unauthorized Deletion of Data

Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72662

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78583

Incorrect Authorization in Kibana Leading to Privilege Escalation

Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to receive a credential carrying arbitrarily elevated Elasticsearch cluster privileges, up to and including full cluster administration.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72676

Improper Control of Generation of Code in Fleet Server Leading to Code Injection

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Fleet Server Kibana

CVE-2026-72672

Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72671

Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72670

Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72669

Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72655

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72633

Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops producing data for that space while the engine continues to report a healthy state to operators.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78595

Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana