CVE-2026-78593: Elastic Kibana

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.

Affected products

• Elastic Kibana: from 8.0.0, up to and including 8.19.20; from 9.0.0, up to and including 9.4.5; from 9.5.0, up to and including 9.5.2

Published 2026-09-03. Last modified 2026-09-08.