SB2026090223 - Multiple vulnerabilities in Kibana
Published: September 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Observable Response Discrepancy (CVE-ID: CVE-2026-78584)
CWE-ID: CWE-204 - Observable Response Discrepancy
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to observable response discrepancy in the Osquery feature when checking scheduled query identifiers across Kibana spaces. A remote user can determine whether a scheduled query identifier exists in a space they are not authorized to access to disclose sensitive information.
Only deployments with the Osquery feature enabled and multiple Kibana spaces configured are affected.
2) Incorrect authorization (CVE-ID: CVE-2026-78598)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose machine learning job data across Kibana spaces.
The vulnerability exists due to incorrect authorization in the Kibana machine learning feature when managing machine learning jobs within a single Kibana space. A remote user can cause a job's saved object to become accessible across all spaces in the Kibana instance to disclose machine learning job data across Kibana spaces.
Deployments are affected only when Kibana spaces are in use and one or more non-administrator users have been granted machine learning job management privileges within a space.
Remediation
Install update from vendor's website.