The vulnerability arises because Kibana executes Elastic Security policy queries against Elasticsearch using an internal account rather than the credentials of the requesting user. Only the Kibana feature privilege is verified, while the caller’s Elasticsearch index privileges are ignored. An authenticated user who possesses Elastic Security feature rights but lacks read access to the Elastic Defend event indices can therefore retrieve field values from those indices, including process command line arguments that often contain tokens, credentials, and connection strings. This flaw is documented as CWE-863 and can lead to sensitive information leakage.

Elastic Kibana when the Elastic Security feature is enabled. No specific version numbers are provided, so the issue applies to all affected releases until patched.

The CVSS score of 7.7 reflects a moderate to high severity for information leakage. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. An attacker must be authenticated and granted the Elastic Security feature privilege; the attack can be performed via the Kibana UI or API without requiring index‑level read permissions. While the attack vector requires internal access, the potential impact on confidential operational data is high. No public exploitation examples are known at this time.