Privilege Escalation Vulnerability in Kibana by Elastic
CVE-2026-78583

8.1HIGH

Key Information:

Vendor

Elastic
Status
Kibana
Vendor
CVE Published:
3 September 2026

What is CVE-2026-78583?

A vulnerability in Kibana allows incorrect validation of Elasticsearch cluster privilege declarations within integration packages. As a result, a user with Fleet management privileges can manipulate input data, leading to arbitrary credential minting for enrolled Elastic Agents. This vulnerability permits escalated privileges, potentially granting full cluster administration rights, which can severely compromise the security of the entire Elasticsearch cluster.

Affected Version(s)

Kibana 8.0.0 <= 8.19.20

Kibana 9.0.0 <= 9.4.5

Kibana 9.5.0 <= 9.5.2

References

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-s...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.