CVE-2026-78584 in Kibana
Summary
by MITRE • 09/02/2026
Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as Observable Response Discrepancy, classified under CWE-204, represents a subtle but significant security flaw within the Kibana Osquery integration feature. This issue arises from an inconsistency in how the application responds to requests for scheduled query identifiers across different access control boundaries. Specifically, when an authenticated user with live-query privileges attempts to interact with a scheduled query identifier located within a Kibana space they do not have authorization to view or manage, the system fails to return a uniform error response. Instead of providing a generic permission denied message that obscures whether the resource exists, the application returns distinct responses based on the existence of the query ID. This discrepancy allows an attacker to infer the presence or absence of specific resources within unauthorized spaces, effectively bypassing logical access controls through side-channel information leakage rather than exploiting a direct code execution flaw.
From a technical perspective, this vulnerability leverages the principle of Observable Response Discrepancy where the application's behavior changes depending on internal state conditions that should be hidden from unprivileged users. In the context of Kibana and Osquery integration, scheduled queries are often tied to specific data spaces or projects designed to isolate tenant data. When a user attempts to query for details about a scheduled ID in an unauthorized space, the backend logic checks both authorization and existence. If the identifier does not exist, it returns one type of error, such as a forty-four hundred bad request or not found response. However, if the identifier exists but the user lacks permissions, it may return a different status code or payload structure indicating access denial rather than non-existence. An attacker can automate this process by iterating through potential query IDs and analyzing the HTTP responses to map out which identifiers are active within restricted environments. This technique aligns with CAPEC-54, Query System for Information, where an adversary probes system inputs to gather intelligence about internal structures without triggering explicit alarms or requiring elevated privileges.
The operational impact of this vulnerability is primarily centered on information disclosure and reconnaissance. While the attacker cannot directly execute queries or view query results in unauthorized spaces, they can successfully enumerate valid scheduled query identifiers across multiple Kibana spaces. This enumeration capability provides valuable context for further attacks. For instance, knowing which Osquery tables are being queried by specific users or teams can reveal sensitive data handling practices, such as whether security logs, user credentials, or network configurations are being monitored. Furthermore, this information aids in mapping the attack surface of the organization's monitoring infrastructure. An attacker could use these discovered identifiers to craft more targeted phishing campaigns against administrators who manage those queries or to identify high-value targets within the environment by correlating query patterns with known security tools and data sources.
To mitigate this risk, organizations must ensure that their Kibana instances are updated to versions where this discrepancy has been resolved through consistent error handling logic. The primary remediation strategy involves modifying the backend response mechanism so that both non-existent resources and unauthorized access attempts return identical HTTP status codes and message bodies. This uniformity ensures that an attacker cannot distinguish between a resource not existing and one being protected by access controls, thereby neutralizing the side-channel attack vector. Additionally, implementing strict rate limiting on Osquery live-query endpoints can slow down automated enumeration attacks, making it more difficult for adversaries to efficiently probe large ranges of identifiers. Security teams should also audit their Kibana configurations to ensure that only necessary users have live-query privileges and that these privileges are scoped tightly to specific data streams rather than broad administrative access. Regular penetration testing focused on logical access control flaws can help identify similar discrepancies in other integrated features before they are exploited by malicious actors seeking to gain deeper insights into the organization's security posture.