Authorization Bypass Vulnerability in Kibana by Elastic
CVE-2026-115295

4.3MEDIUM

Key Information:

Vendor

Elastic
Status
Kibana
Vendor
CVE Published:
3 November 2026

What is CVE-2026-115295?

An authorization bypass vulnerability exists in Kibana, allowing authenticated users with read access to connectors in one space to access connector execution logs from other unauthorized spaces. This can lead to an unintended information disclosure, revealing sensitive data such as connector names, identifiers, execution statuses, timestamps, error messages, and aggregated execution statistics.

Affected Version(s)

Kibana 8.7.0 <= 8.19.23

Kibana 9.0.0 <= 9.4.8

Kibana 9.5.0 <= 9.5.5

References

https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-s...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.