Missing Authorization in Kibana Leads to Unauthorized Actions

CVE-2026-26939

What is CVE-2026-26939?

The vulnerability in Kibana's server-side Detection Rule Management system allows authenticated attackers with rule management privileges to configure unauthorized endpoint response actions. This includes critical functionalities such as host isolation, process termination, and process suspension, all of which can be performed without proper access controls, exposing systems to potential exploitation.

References