CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78584

CVE-2026-78584 is an Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature that allows an authenticated user with Osquery live-query privileges to determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access. The vulnerability affects...

CVE-2026-78598 Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

CVE-2026-78598 Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

CVE-2026-78598 Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

CVE-2026-78598

CVE-2026-78598 is an Incorrect Authorization (CWE-863) flaw in the Kibana machine learning feature. An authenticated user with machine learning job management privileges in a single Kibana space can cause a job's saved object to become accessible across all spaces in the instance, exposing data t...

EUVD-2026-70059

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

PT-2026-84736

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

Kibana 9.4.4 Security Update (ESA-2026-161)

Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-156)

Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An...

Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-92 / ESA-2026-98 / ESA-2026-100 / ESA-2026-104 / ESA-2026-105 / ESA-2026-106 / ESA-2026-110)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-92, ESA-2026-98, ESA-2026-100, ESA-2026-104, ESA-2026-105, ESA-2026-106 and ESA-2026-110 advisories. - Missing...

Kibana 9.1.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-97 / ESA-2026-89)

The version of Kibana installed on the remote host is 9.1.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-89 and ESA-2026-97 advisories. - The Elastic Security capability that suggests existing field values while a user authors endpoint polic...

Kibana 8.19.x < 8.19.20 / 9.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-126 / ESA-2026-127 / ESA-2026-129)

The version of Kibana installed on the remote host is 8.19.x prior to 8.19.20, 9.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-126, ESA-2026-127 and ESA-2026-129 advisories. - Incorrect Authorization CWE-863 in Kiba...

Kibana 8.x < 8.19.20 / 9.x < 9.4.4 Incorrect Authorization (ESA-2026-90)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-90 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations...

BIT-KIBANA-2026-72675 Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

BIT-KIBANA-2026-72629 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...

BIT-ELK-2026-72675 Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

BIT-ELK-2026-72629 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...