Unauthorized Data Manipulation in Kibana by Elastic
CVE-2026-78606

4.2MEDIUM

Key Information:

Vendor

Elastic
Status
Kibana
Vendor
CVE Published:
1 September 2026

What is CVE-2026-78606?

A vulnerability in Kibana allows unauthorized users to access, modify, and delete another user's private Elastic AI Assistant Knowledge Base entries. When two authenticated users from different realms share identical usernames, the access control mechanisms fail, resulting in potential data breaches. This could compromise sensitive information and disrupt user operations, emphasizing the need for stringent access control measures.

Affected Version(s)

Kibana 8.19.11 <= 8.19.20

Kibana 9.3.0 <= 9.4.5

Kibana 9.5.0 <= 9.5.1

References

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-s...

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.