CVE-2026-78597 Overview
CVE-2026-78597 is a Missing Authorization vulnerability [CWE-862] in the Elastic Kibana Entity Store feature. An authenticated user holding only low-privilege Security feature access can invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity. The flaw bypasses the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires. Elastic addressed the issue in Kibana 8.19.21 and 9.4.6.
Critical Impact
Low-privileged authenticated users can create Elasticsearch API keys they should not be able to provision, enabling unauthorized credential issuance within the Kibana Security feature scope.
Affected Products
- Elastic Kibana versions prior to 8.19.21
- Elastic Kibana versions prior to 9.4.6
- Deployments using the Kibana Entity Store feature
Discovery Timeline
- 2026-09-01 - CVE-2026-78597 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-78597
Vulnerability Analysis
The vulnerability resides in an administrative API path exposed by the Kibana Entity Store feature. The Entity Store setup flow is documented as requiring elevated cluster and Kibana privileges because it creates and persists Elasticsearch API keys. The affected endpoint does not enforce those privilege requirements before proceeding.
An authenticated user holding only low-privilege Security feature access can invoke the operation. Kibana then generates an Elasticsearch API key bound to the caller's identity and persists it. The resulting credential can be used to authenticate to Elasticsearch under the caller's effective permissions, and it exists outside the administrative provisioning path that operators expect to control.
Root Cause
The root cause is a missing authorization check on an administrative operation. The Entity Store handler assumes that any authenticated caller reaching it has already satisfied the documented setup prerequisites. No server-side verification confirms the caller holds the required cluster or Kibana privileges before triggering API key creation.
Attack Vector
The attack requires network access to Kibana and valid credentials with low-privilege Security feature access. No user interaction is required. The attacker calls the Entity Store administrative endpoint directly, and Kibana returns or persists an Elasticsearch API key associated with the attacker's account. Refer to the Elastic Security Advisory ESA-2026-155 for vendor-published technical detail.
Detection Methods for CVE-2026-78597
Indicators of Compromise
- Elasticsearch API keys created by user accounts that do not hold the documented Entity Store setup privileges.
- Kibana audit log entries showing Entity Store setup or initialization calls originating from low-privilege Security feature users.
- Unexpected security.create_api_key events in Elasticsearch audit logs correlated with Kibana session identifiers of non-administrative users.
Detection Strategies
- Enable Kibana audit logging and Elasticsearch audit logging, then baseline which principals normally create API keys.
- Alert on API key creation events where the caller's role set does not include the cluster and Kibana privileges required by the Entity Store setup flow.
- Review historical Entity Store initialization calls for the period preceding the upgrade to 8.19.21 or 9.4.6.
Monitoring Recommendations
- Forward Kibana and Elasticsearch audit logs to a centralized analytics platform for correlation of authentication, authorization, and credential provisioning events.
- Track the population of active Elasticsearch API keys and flag new keys owned by accounts outside the administrative group.
- Monitor for repeated Entity Store setup calls from the same low-privilege account, which may indicate probing or automation.
How to Mitigate CVE-2026-78597
Immediate Actions Required
- Upgrade Kibana to 8.19.21 or 9.4.6 or later, per the Elastic advisory.
- Enumerate existing Elasticsearch API keys and invalidate any that were created by users lacking documented Entity Store setup privileges.
- Review Security feature role assignments and remove access from accounts that do not require it.
Patch Information
Elastic released fixed versions Kibana 8.19.21 and 9.4.6 under advisory ESA-2026-155. The patch enforces the elevated cluster and Kibana privilege requirements on the Entity Store administrative operation so that low-privilege callers can no longer trigger API key creation. Consult the Elastic security update for version-specific guidance.
Workarounds
- Restrict Kibana Security feature access to accounts that already meet the Entity Store setup privilege requirements until patching is complete.
- Disable or avoid using the Entity Store feature in affected versions where operationally acceptable.
- Rotate and audit Elasticsearch API keys on a defined schedule to shorten the useful lifetime of any unauthorized credentials.
# Configuration example: list and invalidate suspicious API keys via Elasticsearch API
curl -u elastic -XGET "https://<es-host>:9200/_security/api_key?owner=false"
curl -u elastic -XDELETE "https://<es-host>:9200/_security/api_key" \
-H 'Content-Type: application/json' \
-d '{"ids":["<api_key_id>"]}'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
