Incorrect Authorization in Kibana's Elastic AI Assistant Knowledge Base allows an authenticated user to read, modify, and delete private Knowledge Base entries belonging to a different user when both principals share an identical username value but originate from distinct authentication realms. Elastic advisory ESA-2026-142 confirms the flaw across multiple 8.x and 9.x release lines, with fixed versions 8.19.21, 9.4.6, and 9.5.2 released. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; exploitation is gated by a high-complexity prerequisite - a username collision across separately configured authentication realms - which significantly limits the exposed population.
Elastic
Kibana
NVD
CVSS 3.1
4.2
EPSS
0.1%
Prev
Page 4 of 4