Missing Authorization in Kibana Fleet Feature Exposes Sensitive Information

CVE-2026-78595

What is CVE-2026-78595?

The Kibana Fleet feature is susceptible to missing authorization flaws, which may facilitate unauthorized access to sensitive information. Authenticated users with read-level privileges in one Kibana space can improperly enumerate agent metadata and access diagnostic content from agents registered in different spaces, resulting in potential information disclosure and privilege abuse scenarios. This vulnerability underscores the importance of implementing stringent access controls to safeguard critical data across Kibana environments.

References