Sensitive Information Exposure in Kibana Observability by Elastic
CVE-2026-115293

6.5MEDIUM

Key Information:

Vendor

Elastic
Status
Kibana
Vendor
CVE Published:
3 November 2026

What is CVE-2026-115293?

A vulnerability in Kibana Observability onboarding allows an authenticated user to inadvertently expose sensitive credentials used for Elasticsearch connections. When configured incorrectly, these credentials can be embedded in the Elasticsearch host URLs, giving users with onboarding privileges access to Elasticsearch directly, utilizing the service account's permissions which exceed their own granted privileges. This could lead to potential unauthorized actions within the Elasticsearch environment.

Affected Version(s)

Kibana 8.10.0 <= 8.19.23

Kibana 9.0.0 <= 9.4.8

Kibana 9.5.0 <= 9.5.5

References

https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-s...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.