The vulnerability in Kibana’s Observability onboarding allows an attacker who has authentication to upload observability data to read sensitive service‑account credentials that are embedded in Elasticsearch host URLs. These credentials are transmitted as part of the sent data, enabling the attacker to acquire full access to Elasticsearch with the privileges of the Kibana service account, which are higher than the attacker’s own privileges. This represents a direct disclosure of credentials that can be leveraged to compromise the underlying data store and any other resources that the service account can access.

The affected product is Elastic Kibana. No specific version range is provided in the CNA data, but the issue is known to exist in the Kibana releases referenced in the vendor discussion. Administrators should verify the installed version against the security update referenced and ensure the product is updated accordingly.

The CVSS score of 6.5 indicates moderate to high impact. The Exploit Prediction Scoring System (EPSS) score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not documented. However, the attack requires an authenticated user with observability onboarding privileges; thus the effective attack vector is internal or privileged. The risk is that if these conditions are met, attackers can obtain service‑account credentials and subsequently access Elasticsearch with elevated privileges.