CVE-2026-78597 in Kibana
Summary
by MITRE • 09/01/2026
Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified as a Missing Authorization flaw within the Kibana Entity Store feature represents a critical failure in access control mechanisms, specifically categorized under CWE-862. This security defect allows an authenticated user with only low-privilege permissions related to general Security features to execute administrative operations that are strictly intended for users with elevated cluster and Kibana privileges. The core technical flaw lies in the application's inability to properly constrain functionality based on Access Control Lists, which aligns with CAPEC-1, or Accessing Functionality Not Properly Constrained by ACLs. In a correctly secured environment, operations that modify system-wide configurations or create persistent credentials should require explicit verification of high-level administrative rights before execution. However, in this instance, the backend logic fails to validate whether the requesting user possesses the necessary elevated privileges for the specific action being performed, relying instead on insufficient checks that can be bypassed by lower-privileged accounts.
The operational impact of this vulnerability is severe due to its ability to facilitate unauthorized credential creation via Elasticsearch API keys. When a low-privilege user successfully invokes the affected administrative operation, the system creates and persists an Elasticsearch API key under the identity of the caller rather than restricting it or rejecting the request. This effectively grants the attacker persistent access credentials that can be used to interact with the underlying Elasticsearch cluster. Since these API keys are tied to the user's identity but created through a privileged pathway, they may inherit broader permissions depending on how Kibana maps entity store roles to Elasticsearch security roles. This allows an attacker to escalate their privileges from basic read or limited write access to potentially full administrative control over the data layer, enabling them to exfiltrate sensitive information, modify critical configurations, or disrupt service availability without detection by standard privilege monitoring tools that only track explicit role assignments rather than API key generation events.
From a threat modeling perspective, this vulnerability enables an attacker to establish a persistent foothold within the Elasticsearch infrastructure using legitimate authentication mechanisms, thereby evading many signature-based intrusion detection systems. The creation of unauthorized API keys provides a stable channel for lateral movement and data access that persists even if session tokens are rotated or expired. This aligns with ATT&CK techniques related to Credential Access and Persistence, as the attacker leverages valid credentials obtained through privilege escalation to maintain long-term access. The lack of proper authorization checks means that standard audit logs may not immediately flag this activity as anomalous since it appears to originate from a legitimate user session, making forensic analysis more challenging for security operations teams who must distinguish between authorized administrative actions and those executed via this specific exploitation path.
Mitigation strategies should focus on immediate remediation through vendor patches if available, ensuring that the Kibana Entity Store feature is updated to enforce strict role-based access control checks before allowing any operation that results in credential generation or modification of system entities. Administrators must verify that their current version includes fixes for this specific authorization bypass and apply them promptly across all instances. In environments where patching cannot be immediately implemented, network-level controls such as restricting direct Elasticsearch API access to authorized administrative IPs can provide a compensating control. Additionally, security teams should enhance monitoring by auditing the creation of new Elasticsearch API keys, particularly those generated outside of standard user login flows or from users with low initial privilege levels. Implementing strict separation of duties and ensuring that Entity Store configurations are reviewed for over-permissive role mappings will further reduce the attack surface associated with this vulnerability.