Description
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.
Published: 2026-09-01
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

The vulnerability is a missing authorization check (CWE‑862) in an internal Kibana APM integration function. Any authenticated Kibana user can request APM server credentials that should only be visible to users with APM or Fleet administrative privileges. This results in the disclosure of sensitive credentials that could be used to access the APM server and potentially other downstream systems.

Affected Systems

Elastic Kibana is affected. Version details are not specified in the data provided; only the vendor and product are identified.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The attack requires an authenticated Kibana user but does not require elevated privileges; thus, any user who can log in to Kibana can exploit the flaw to read restricted APM server credentials.

Generated by OpenCVE AI on September 2, 2026 at 02:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Kibana to the latest patched release as published by Elastic (for example 8.19.21 or later, see the discussion at Elastic’s security advisory).
  • Restrict the roles that can access the APM integration function to only users with APM or Fleet administrative privileges.
  • If the integration is not required, disable or remove the APM integration endpoint to eliminate the attack surface.
  • Verify that APM server credentials are no longer exposed in web interfaces, logs, or API responses after remediation.

Generated by OpenCVE AI on September 2, 2026 at 02:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*

Wed, 02 Sep 2026 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Elastic
Elastic kibana
Vendors & Products Elastic
Elastic kibana

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.
Title Missing Authorization in Kibana Leading to Information Disclosure
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Elastic Kibana
cve-icon MITRE

Status: PUBLISHED

Assigner: elastic

Published:

Updated: 2026-09-01T19:41:36.004Z

Reserved: 2026-08-24T21:13:52.890Z

Link: CVE-2026-78608

cve-icon Vulnrichment

Updated: 2026-09-01T19:41:33.073Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-01T20:17:24.160

Modified: 2026-09-02T14:53:24.960

Link: CVE-2026-78608

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T02:45:03Z

Weaknesses