CVE-2026-78608: Elastic Kibana Information Disclosure Flaw

CVE-2026-78608 is an information disclosure vulnerability in Elastic Kibana caused by missing authorization controls. Authenticated users can access APM server credentials reserved for administrators. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-78608 Overview

CVE-2026-78608 is a missing authorization vulnerability in Elastic Kibana that exposes Application Performance Monitoring (APM) server credentials to any authenticated user. The flaw resides in an internal Kibana APM integration function that fails to enforce role-based access controls. Under a correct configuration, only users with APM or Fleet administrative privileges should read these credentials. The weakness maps to CWE-862: Missing Authorization and enables Privilege Abuse (CAPEC-122). Elastic addressed the issue in Kibana 8.19.21, 9.4.6, and 9.5.2.

Critical Impact
Any authenticated Kibana user can read APM server credentials intended for administrators, enabling downstream access to telemetry pipelines and potential lateral movement.

Affected Products

Elastic Kibana versions prior to 8.19.21
Elastic Kibana 9.x versions prior to 9.4.6
Elastic Kibana 9.5.x versions prior to 9.5.2

Discovery Timeline

2026-09-01 - CVE-2026-78608 published to NVD
2026-09-02 - Last updated in NVD database
ESA-2026-144 - Elastic publishes security advisory and patched builds

Technical Details for CVE-2026-78608

Vulnerability Analysis

The vulnerability lives in an internal Kibana APM integration function that returns APM server credentials. The function omits an authorization check that would normally restrict access to users with APM or Fleet administrative roles. As a result, the endpoint honors authentication but ignores the privilege model entirely.

An attacker with any valid Kibana session can invoke the affected function and retrieve secrets. The credentials in scope allow ingestion or configuration of APM data flows, which often traverse production application infrastructure. Disclosure is confined to confidentiality; the flaw does not modify data or affect availability directly.

Root Cause

The root cause is a missing authorization control on a server-side function within the APM integration surface. Kibana authenticates the caller but does not verify that the caller holds apm_user, apm_admin, or Fleet management privileges before returning secret material. This is a classic broken access control pattern where authorization logic is assumed at the UI layer rather than enforced on the server.

Attack Vector

Exploitation requires network access to Kibana and valid low-privilege credentials. No user interaction and no elevated permissions are required. An attacker sends an authenticated request to the vulnerable APM integration function and receives the APM server credentials in the response. The recovered credentials can then be used to authenticate to APM Server and read or write telemetry, or to pivot into services that trust APM ingestion tokens.

No public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Elastic Security Update ESA-2026-144 for vendor detail.

Detection Methods for CVE-2026-78608

Indicators of Compromise

Kibana audit log entries showing low-privilege user accounts invoking APM integration or Fleet-related internal APIs.
Unexpected authentication events to APM Server originating from users who do not hold apm_admin or Fleet management roles.
Requests to /api/apm/* or /internal/apm/* paths from accounts with only viewer or custom read-only roles.

Detection Strategies

Enable Kibana audit logging and alert on access to APM integration endpoints by non-administrative principals.
Correlate Kibana session identifiers with subsequent APM Server authentications to detect credential reuse.
Review Elasticsearch role mappings to enumerate accounts that had read access to Kibana during the exposure window.

Monitoring Recommendations

Forward Kibana and Elasticsearch audit logs to a centralized SIEM for retention and correlation.
Baseline normal APM administrative activity by user and role, then alert on deviations.
Monitor for programmatic access patterns such as automated iteration over Kibana /internal/* endpoints.

How to Mitigate CVE-2026-78608

Immediate Actions Required

Upgrade Kibana to 8.19.21, 9.4.6, or 9.5.2 or later depending on your deployment branch.
Rotate all APM server credentials, API keys, and Fleet enrollment tokens that were readable through the affected function.
Review Kibana user accounts and remove unused or over-privileged sessions.

Patch Information

Elastic released fixed builds under advisory ESA-2026-144. Upgrade paths are documented in the Elastic Security Update ESA-2026-144 advisory. Fixed versions enforce the APM or Fleet administrative privilege check on the previously unprotected function.

Workarounds

Restrict network access to Kibana so that only trusted administrative users can authenticate until patches are applied.
Reduce the pool of authenticated Kibana users by disabling non-essential accounts and integrations.
Rotate APM credentials proactively and issue short-lived API keys where possible to limit the value of any leaked secret.

bash

# Rotate APM Server API keys via Elasticsearch after patching
curl -u elastic -X POST "https://es.example.internal:9200/_security/api_key" \
  -H 'Content-Type: application/json' -d '{
    "name": "apm-server-key-rotated",
    "role_descriptors": {
      "apm_writer": {
        "cluster": ["monitor"],
        "index": [{"names": ["apm-*"], "privileges": ["create_doc","auto_configure"]}]
      }
    },
    "expiration": "30d"
  }'