CVE-2026-78603: Elastic Kibana

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.

Affected products

• Elastic Kibana: from 9.0.0, before 9.4.6 (fixed in 9.4.6); version 9.5.0 only

Published 2026-09-01. Last modified 2026-09-02.