[NEW] [high] Kibana: Multiple vulnerabilities
A remote, authenticated attacker can exploit multiple vulnerabilities in Kibana to escalate privileges, bypass security measures, manipulate or disclose data, or cause a denial-of-service condition.
CSIRTS triage
- What
- Multiple vulnerabilities in Kibana allow authenticated attackers to escalate privileges, bypass security, disclose or manipulate data, and cause denial-of-service.
- Who is affected
- Authenticated users with access to affected Kibana deployments can exploit these vulnerabilities.
- Urgency
- High severity; multiple privilege escalation paths and data manipulation vectors present.
- Action
- Apply Elastic security patches for Kibana to the latest available version.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Kibana
Get an email when a new Kibana advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3145
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- mediumCVE-2026-82293: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthori…nvd
- mediumCVE-2026-78601: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abu…nvd
- mediumCVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the…nvd
- mediumCVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to informati…nvd
- mediumCVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the…nvd
- highCVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the…nvd
- mediumCVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial …nvd
- mediumCVE-2026-78584: Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to informatio…nvd
- unknownMultiple vulnerabilities in Elastic products (02 September 2026)cert-fr-avis
- mediumCVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abu…nvd
- mediumCVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification,…nvd
- mediumCVE-2026-78603: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting In…nvd
Recent advisories for Kibana
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-82293: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthori…nvd · 2026-09-02
- mediumCVE-2026-78601: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abu…nvd · 2026-09-02
- mediumCVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the…nvd · 2026-09-02
- mediumCVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to informati…nvd · 2026-09-02
- mediumCVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the…nvd · 2026-09-02
- highCVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the…nvd · 2026-09-02
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] IBM i: Multiple Vulnerabilities2026-09-03
- medium[NEW] [medium] Sonatype Nexus Repository Manager: Multiple Vulnerabilities Enable Denial of Service2026-09-03
- high[NEW] [high] BigBlueButton: Multiple Vulnerabilities2026-09-03
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities2026-09-03
- medium[NEW] [medium] Red Hat Enterprise Linux (libsolv, aardvark-dns): Multiple vulnerabilities2026-09-03