Missing Authorization in Kibana - CVE-2026-78596
Published: September 3, 2026
Vulnerability identifier: #VU146878
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-78596
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify data outside their authorized Kibana space.
The vulnerability exists due to missing authorization in Entity Analytics migration operations when triggering migration operations from a single Kibana space. A remote user can trigger Entity Analytics migration operations to modify data outside their authorized Kibana space.
Only Kibana deployments where the Entity Analytics feature has been initialized in at least one space are affected. Multi-space deployments face broader impact due to the cross-space nature of the operation.
Affected software
Kibana
How to mitigate CVE-2026-78596
Install security update from vendor's website.
Kibana - addressed in versions 8.19.21, 9.4.6, 9.5.3