Kibana CVE-2026-49092

Exploitation requires a valid Kibana account with at least low-level privileges (CVSS PR:L confirms authentication is required). The confused deputy condition is triggered only under certain conditions - the exact Kibana feature or configuration path is not disclosed in available data, but the CWE-441/CAPEC-1 pattern suggests it involves a shared or delegated server-side operation where Kibana does not re-check the initiating user's authorization before using another user's credentials to fetch data. The target deployment must have multiple users with differentiated access levels (role-based access control in use); in single-user or fully-trusted deployments there is no meaningful privilege boundary to cross. Exploitation is limited to confidentiality - no integrity or availability impact is possible via this path. Remote unauthenticated exploitation is not possible (PR:L, not PR:N).

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N captures the real attack surface reasonably well: network-reachable Kibana instances with multi-user deployments are in scope, no elevated complexity or user interaction is required, and the attacker needs only a low-privilege Kibana account. The scope is unchanged (S:U), meaning exploitation stays within the Kibana/Elasticsearch trust boundary and does not pivot to other systems directly. Confidentiality impact is rated Low (C:L), which likely reflects partial rather than total data exposure - the attacker can see data from sources they are unauthorized for, but only in specific contexts where the confused deputy condition is triggered. No EPSS score was provided, so exploitation probability cannot be quantified. No KEV listing means CISA has not confirmed active exploitation. No public POC has been identified. Despite the moderate CVSS score, this is a meaningful risk in environments with strict data-separation requirements (HIPAA, PCI-DSS, multi-tenant SaaS), where even partial unauthorized data access constitutes a compliance breach. In single-user or fully-trusted-user deployments, the practical risk is negligible. CVSS and real-world risk are broadly aligned here - this is not a case of inflated or deflated scoring.

An authenticated Kibana user with a low-privilege role - for example, a user restricted to read access on a single index - crafts or triggers a specific Kibana operation (such as loading a shared dashboard, running a saved search, or triggering an alert) that internally causes Kibana to execute an Elasticsearch query on their behalf using a higher-privileged user's session context. Kibana returns results from an Elasticsearch index the low-privilege user is not authorized to query directly, exposing restricted data. No public exploit code exists at time of analysis, but the attack is low-complexity once the triggering condition in Kibana's feature set is identified.