CVE-2026-78584: Kibana Osquery Information Disclosure

CVE-2026-78584 Overview

CVE-2026-78584 is an information disclosure vulnerability in the Kibana Osquery feature. The flaw is classified as an Observable Response Discrepancy [CWE-204] and maps to CAPEC-54 (Query System for Information). An authenticated user holding Osquery live-query privileges can determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access. The issue was disclosed by Elastic in security update ESA-2026-161 alongside the Kibana 9.4.4 release.

Critical Impact
Authenticated attackers with limited Osquery privileges can enumerate scheduled query identifiers across Kibana spaces they should not access, leaking metadata about tenant configurations.

Affected Products

Kibana Osquery feature (versions prior to 9.4.4)
Elastic Kibana deployments using multi-space isolation
Elastic Stack installations exposing Osquery live-query privileges to non-administrative users

Discovery Timeline

2026-09-02 - CVE-2026-78584 published to NVD
2026-09-02 - Elastic published security update ESA-2026-161 for Kibana 9.4.4
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78584

Vulnerability Analysis

The vulnerability resides in the Kibana Osquery feature's handling of scheduled query identifiers. Kibana enforces space-based access control to segregate data and configurations across tenant boundaries. The Osquery live-query API returns responses that vary based on whether a requested scheduled query identifier exists, even when the requesting user lacks authorization to the space that owns it.

This behavior constitutes an Observable Response Discrepancy [CWE-204]. An attacker with valid credentials and Osquery live-query privileges can submit crafted requests referencing identifiers in other spaces. The differing response signals allow the attacker to confirm or deny the existence of those identifiers without direct access to their contents.

The impact is limited to confidentiality of metadata. The vulnerability does not permit arbitrary data retrieval, modification, or denial of service. However, leaked identifier existence can support reconnaissance for further multi-tenant attacks.

Root Cause

The root cause is inconsistent authorization enforcement in the Osquery API response path. The feature evaluates whether a scheduled query identifier exists before fully applying space-level authorization checks. This ordering produces distinguishable error responses for existing versus non-existing identifiers.

Attack Vector

Exploitation requires network access to the Kibana interface and an authenticated session with Osquery live-query privileges. The attacker iterates candidate scheduled query identifiers and observes response differences to infer which identifiers exist in unauthorized spaces. No user interaction is required. See the Elastic Security Update ESA-2026-161 for vendor technical details.

Detection Methods for CVE-2026-78584

Indicators of Compromise

Repeated Osquery API requests from a single authenticated user referencing scheduled query identifiers across multiple Kibana spaces
Unusual volume of Osquery live-query API calls returning distinct error codes correlated with identifier enumeration attempts
Authentication sessions with Osquery privileges accessing resources outside their assigned space context

Detection Strategies

Enable Kibana audit logging and alert on Osquery API requests that reference identifiers outside the caller's authorized spaces
Baseline normal Osquery live-query volume per user and flag statistical deviations that suggest enumeration behavior
Correlate Kibana authentication events with Osquery API activity to identify accounts probing multiple spaces

Monitoring Recommendations

Ingest Kibana audit logs into a centralized SIEM and build detections for cross-space identifier probing
Monitor error-code distributions on Osquery endpoints; a shift toward uniform responses after patching confirms remediation
Track privileged Osquery role assignments and review them against least-privilege policy on a recurring cadence

How to Mitigate CVE-2026-78584

Immediate Actions Required

Upgrade Kibana to version 9.4.4 or later as directed by Elastic Security Update ESA-2026-161
Audit all users and roles that hold Osquery live-query privileges and revoke access where not required
Review Kibana space configurations to confirm that tenant boundaries align with current authorization needs

Patch Information

Elastic addressed the vulnerability in Kibana 9.4.4. Details are published in the Elastic Security Update ESA-2026-161. Administrators running earlier 9.x releases should plan the upgrade promptly.

Workarounds

Restrict Osquery live-query privileges to a minimal set of trusted administrators until the upgrade is complete
Segment sensitive scheduled queries into dedicated Kibana deployments where cross-space enumeration is not possible
Increase monitoring granularity on Osquery API endpoints to identify enumeration attempts while the patch is being deployed

bash

# Configuration example
# Verify Kibana version after upgrade
curl -u <admin_user> -X GET "https://<kibana_host>:5601/api/status" \
  -H "kbn-xsrf: true" | jq '.version.number'
# Expected output: "9.4.4" or later