CVE-2026-78603 Overview
CVE-2026-78603 is a missing authorization vulnerability [CWE-862] in Elastic Kibana. An authenticated user with minimal Elasticsearch privileges can bypass Kibana feature authorization and space access controls. The bypass exposes Fleet deployment metadata from the default Kibana space to users who should not have visibility into it.
The vulnerability aligns with CAPEC-180 (Exploiting Incorrectly Configured Access Control Security Levels). It affects Kibana 9.5.0 and prior versions in the 9.4.x and 9.5.x branches. Elastic addressed the issue in Kibana 9.4.6 and 9.5.1 under advisory ESA-2026-149.
Critical Impact
Any authenticated Elasticsearch user, regardless of assigned Kibana space, can read Fleet deployment metadata from the default space without authorization.
Affected Products
- Elastic Kibana 9.4.x prior to 9.4.6
- Elastic Kibana 9.5.0
- Deployments using Fleet within the default Kibana space
Discovery Timeline
- 2026-09-01 - CVE-2026-78603 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-78603
Vulnerability Analysis
Kibana enforces access to features and data through two mechanisms: feature-level authorization and space-based isolation. Feature authorization determines which applications a user can access. Space isolation restricts data visibility to configured Kibana spaces.
CVE-2026-78603 breaks both controls for Fleet metadata. An authenticated user with only minimal Elasticsearch privileges can retrieve Fleet deployment information from the default space. The user does not need Fleet-related Kibana privileges or membership in the default space.
The disclosed metadata includes Fleet deployment configuration data managed by Kibana. Confidentiality impact is limited; the vulnerability does not permit modification of Fleet assets or affect availability of the Kibana instance.
Root Cause
The root cause is a missing authorization check on the code path that returns Fleet deployment metadata. The handler validates that the caller is authenticated but does not enforce the Kibana feature privilege for Fleet or the space membership required to read default-space objects. Authorization decisions rely on Elasticsearch role membership alone, which is not sufficient for Kibana-managed resources.
Attack Vector
Exploitation requires network access to the Kibana API and valid credentials for any Elasticsearch account, including low-privileged read-only users. The attacker sends an authenticated request to the affected Fleet metadata endpoint. Because authorization is missing, Kibana returns Fleet deployment metadata from the default space regardless of the caller's assigned space or feature privileges.
No user interaction is required, and no elevated privileges are needed beyond a working authenticated session. See the Elastic Security Update ESA-2026-149 for vendor technical details.
Detection Methods for CVE-2026-78603
Indicators of Compromise
- Authenticated requests to Fleet metadata endpoints originating from user accounts that have no assigned Fleet feature privileges.
- Kibana audit log entries showing successful reads of Fleet objects by users outside the default space.
- Anomalous API access patterns from service accounts or read-only Elasticsearch users targeting Fleet routes.
Detection Strategies
- Enable Kibana audit logging and alert on Fleet API access by users whose role mappings do not include Fleet privileges.
- Correlate Elasticsearch authentication events with Kibana API calls to identify low-privileged accounts reading Fleet metadata.
- Baseline normal Fleet API consumers, such as Fleet Server and administrators, and flag deviations.
Monitoring Recommendations
- Forward Kibana and Elasticsearch audit logs to a centralized SIEM for retention and query.
- Track the Kibana version reported by /api/status to identify hosts still running vulnerable builds.
- Review role mappings quarterly to confirm least-privilege assignment for Elasticsearch users with Kibana access.
How to Mitigate CVE-2026-78603
Immediate Actions Required
- Upgrade Kibana 9.4.x deployments to 9.4.6 or later.
- Upgrade Kibana 9.5.x deployments to 9.5.1 or later.
- Audit existing Elasticsearch users and revoke unnecessary Kibana access from low-privileged accounts.
- Review Fleet audit logs for prior unauthorized access to deployment metadata.
Patch Information
Elastic released fixes in Kibana 9.4.6 and 9.5.1. The vendor advisory is published as ESA-2026-149 on the Elastic discussion forum. Refer to the Elastic Security Update ESA-2026-149 for release artifacts and upgrade instructions.
Workarounds
- Restrict network access to the Kibana API to trusted administrative networks until patches are applied.
- Remove Kibana access from Elasticsearch users who do not require it, minimizing the pool of accounts that can reach the vulnerable endpoint.
- Monitor Fleet API access closely and alert on unauthorized reads during the remediation window.
# Verify installed Kibana version and confirm patched build
curl -u <admin_user> -s https://<kibana_host>:5601/api/status | \
grep -o '"number":"[^"]*"'
# Expected patched output: "number":"9.4.6" or "number":"9.5.1" or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
