Kibana CVE-2026-78581

Exploitation requires an authenticated Kibana session with at least low-privilege access (PR:L per CVSS vector). The attacker must additionally obtain a specific AI Assistant conversation identifier belonging to another user; this identifier is described as hard-to-guess, which is reflected in AC:H. The AI Assistant feature must be enabled and in active use by the victim user, generating conversation records with identifiers. Exploitation is limited to reading or modifying AI conversation content - it does not affect underlying Elasticsearch indices, Kibana dashboards, or authentication mechanisms. Unauthenticated external attackers are categorically excluded by the PR:L requirement.

The CVSS 3.1 base score of 4.2 (Medium) is consistent with the available signals and reflects a genuinely limited-impact vulnerability. AV:N confirms network-accessible exploitation, but AC:H reflects the requirement to know a hard-to-guess conversation identifier - a meaningful practical barrier that reduces opportunistic exploitation. PR:L requires a valid authenticated session, ruling out unauthenticated external attackers. Scope is Unchanged (S:U), impact is limited to Low confidentiality and Low integrity - an attacker can read or alter another user's AI conversation content but cannot escalate privileges, exfiltrate credentials, or affect availability. No EPSS score was provided in the input data; it is INFERRED to be low given the AC:H constraint, authentication requirement, and niche feature scope. No CISA KEV listing and no public POC exist, making real-world exploitation unlikely outside targeted insider scenarios. This is a genuine IDOR that warrants patching but should not be prioritized above critical or actively exploited vulnerabilities in the same environment.

An authenticated Kibana user with low-level privileges who has obtained another user's AI Assistant conversation identifier - through log exposure, API response enumeration, or social engineering - crafts a direct API request referencing that foreign conversation ID. The server processes the request without validating ownership, returning or accepting modifications to conversation content belonging to the victim user. No public proof-of-concept code exists at time of analysis.