CVE-2026-78599

Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78601

Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78598

Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data

Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding machine learning job management privileges within a single Kibana space could cause a job's saved object to become accessible across all spaces in the Kibana instance, without holding access rights to those additional spaces.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78584

Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-82293

Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption

Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learning functionality beyond their authorization scope, consuming cluster resources they should not be able to reach.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78597

Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78607

Missing Authorization in Elasticsearch Leading to Information Disclosure

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-78605

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-72654

Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather than the identity of the requesting user. Such a user could therefore receive data from Elasticsearch indices they are not authorized to read. No Elasticsearch cluster or index privileges are required.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72649

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-49096

Uncaught Exception in Kibana Cases Leading to Denial of Service

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72630

Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation

Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72631

Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys

Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78608

Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78606

Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78603

Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78592

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag management interface to act on an unintended target, resulting in the deletion of privileged resources including administrative accounts and other organizational assets. Exploitation requires an administrator to interact with the affected interface.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72682

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, terminating the process and denying service to all users of the instance.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72652

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72644

Uncaught Exception in Kibana Leading to Denial of Service

Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana