CVE-2026-78597

EUVD-2026-69574

01.09.2026, 20:17

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
elastic	CNA	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
elastic	kibana	8.0.0 ≤ 𝑥 ≤ 8.19.20	CNA
elastic	kibana	9.0.3 ≤ 𝑥 ≤ 9.4.5	CNA

Common Weakness Enumeration

CWE-862 - Missing Authorization
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

References

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-security-update-esa-2026-155/390072