CVE-2026-78601: Kibana Information Disclosure Vulnerability

CVE-2026-78601 Overview

CVE-2026-78601 is a Missing Authorization vulnerability [CWE-862] affecting Kibana. The flaw exists in the Kibana Entity Store configuration operation, which fails to enforce authorization checks on a background task. An authenticated user with elevated Kibana privileges can trigger the task to read from Elasticsearch indices they are not authorized to access. The entity store then exposes derived entity data from those indices, resulting in information disclosure. Elastic addressed the issue in Kibana 9.4.5 through security advisory ESA-2026-147.

Critical Impact
An authenticated attacker with elevated Kibana privileges can indirectly read data from restricted Elasticsearch indices and retrieve derived entity data through the entity store output.

Affected Products

Kibana (versions prior to 9.4.5)
Elastic Stack deployments using the Kibana Entity Store feature
Elasticsearch indices exposed through Kibana entity aggregation

Discovery Timeline

2026-09-02 - CVE-2026-78601 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78601

Vulnerability Analysis

The vulnerability resides in Kibana's Entity Store configuration workflow. The Entity Store aggregates and enriches entity data by reading from Elasticsearch indices in the background. Kibana normally enforces role-based access control (RBAC) on index-level reads, but the configuration operation for the Entity Store omits this check. An authenticated user with elevated Kibana privileges can configure the store to include indices outside their authorization scope. The background task executes with sufficient permissions to read those indices and pushes derived entity fields to the entity store output. The requester then observes data they should not have been able to reach directly, categorizing this as an indirect authorization bypass leading to information disclosure.

Root Cause

The root cause is a missing authorization control on the Entity Store configuration API. Kibana does not validate that the requesting user has read access to the Elasticsearch indices referenced in the configuration. The background task runs with broader privileges than the requesting user, creating a privilege abuse path (CAPEC-122). This pattern is a common instance of confused deputy behavior in delegated task execution.

Attack Vector

Exploitation requires network access to the Kibana instance and an authenticated session with elevated Kibana privileges. The attacker submits a crafted Entity Store configuration referencing target Elasticsearch indices. The background task executes and enriches entity records with data from those indices. The attacker retrieves the derived entity data through standard entity store output paths. No user interaction is required, and no code execution occurs. The attack impacts confidentiality of restricted index data and, to a limited extent, integrity of the entity store output. See the Elastic Security Update ESA-2026-147 for vendor technical details.

Detection Methods for CVE-2026-78601

Indicators of Compromise

Unexpected Entity Store configuration changes made by users who do not typically administer entity analytics
Entity store outputs containing fields sourced from Elasticsearch indices restricted by role mappings
Background task audit entries reading indices outside the requesting user's assigned index privileges

Detection Strategies

Enable Kibana audit logging and alert on entity_store configuration events correlated with the requesting user's role
Compare index sources referenced in Entity Store configurations against the requester's Elasticsearch role privileges to identify mismatches
Review Elasticsearch slow-log and audit-log entries for background task reads against indices holding regulated or restricted data

Monitoring Recommendations

Forward Kibana and Elasticsearch audit logs to a centralized SIEM for correlation between user identity, configuration changes, and downstream index reads
Baseline normal Entity Store configuration activity and alert on deviations by user, frequency, or index scope
Monitor privileged Kibana role assignments and flag additions to roles that grant Entity Store administrative capabilities

How to Mitigate CVE-2026-78601

Immediate Actions Required

Upgrade Kibana to version 9.4.5 or later, which contains the fix released under ESA-2026-147
Audit all users assigned elevated Kibana privileges and remove unnecessary role grants
Review existing Entity Store configurations and validate that referenced indices align with intended data exposure boundaries

Patch Information

Elastic released the fix in Kibana 9.4.5. The patched build enforces authorization checks on the Entity Store configuration operation so that background tasks cannot read Elasticsearch indices outside the requesting user's authorized scope. Details are published in the Elastic Security Update ESA-2026-147.

Workarounds

Restrict Kibana privileges required for Entity Store administration to a minimal set of trusted operators until patching is complete
Disable the Entity Store feature in environments where it is not actively required
Apply document- and field-level security in Elasticsearch to limit the scope of data reachable by background tasks

bash

# Configuration example
# Verify Kibana version prior to upgrade
curl -u elastic:$PASSWORD -k https://kibana.example.local:5601/api/status | jq '.version.number'

# Upgrade Kibana package (Debian/Ubuntu)
sudo apt-get update && sudo apt-get install --only-upgrade kibana=9.4.5

# Restart the Kibana service after upgrade
sudo systemctl restart kibana