EUVD-2026-58288
GHSA-m5pm-2p35-xvpr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-reachable via Kibana API, low complexity once realm overlap exists, low-privilege authenticated session required, high confidentiality impact on agent config, low integrity impact from modification or deletion.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that share a username in different realms are treated as the same owner. This discloses the configuration and instructions of an agent the caller does not own, and allows that agent to be altered or removed.
AnalysisAI
Incorrect authorization in Kibana Agent Builder allows authenticated users to access, modify, or delete private agents they do not own when sharing a username with another principal across different Elasticsearch authentication realms. The flaw stems from a fallback ownership check that compares usernames - which are not unique across realms - rather than stable user identifiers, enabling cross-realm identity confusion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target Kibana deployment must be configured with two or more Elasticsearch authentication realms (e.g., a native realm and an LDAP/Active Directory realm operating simultaneously); (2) the attacker and victim must share an identical username string in their respective realms; (3) the attacker must hold a valid low-privilege authenticated session in Kibana (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores 7.1, indicating a high-severity, network-reachable flaw requiring only low-privilege authentication with no user interaction or special complexity from the attacker's perspective. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kibana to version 9.4.5 or 9.5.1 per Elastic security advisory ESA-2026-124 (https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-124/389538). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Kibana deployments using Agent Builder and document which authentication realms are enabled; verify username uniqueness across all configured realms. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Kibana versions up to 9.3.0 contains a vulnerability that allows attackers to read arbitrary files from the Kibana serve
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today