EUVD-2026-70657
GHSA-3963-6mf6-92mq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
S:C over vendor S:U because the flaw in Kibana directly propagates elevated credentials into the distinct Elasticsearch cluster and all enrolled agents.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to receive a credential carrying arbitrarily elevated Elasticsearch cluster privileges, up to and including full cluster administration.
AnalysisAI
Privilege escalation in Kibana's Fleet management component allows any user holding Fleet management privileges to mint arbitrarily elevated Elasticsearch cluster credentials - up to full cluster administration - for every Elastic Agent enrolled in a targeted policy. Elasticsearch cluster privilege declarations sourced from integration packages were not validated before being used to generate agent credentials (CWE-863: Incorrect Authorization), enabling an attacker to inject overprivileged credentials across an entire agent fleet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Kibana account with the Fleet management role (or equivalent privilege to create or modify integration packages and Fleet policies). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) captures the core metrics well, but the S:U (unchanged scope) designation is arguable: the attack originates in Kibana's Fleet component yet delivers its impact by elevating credentials used against a distinct system - the Elasticsearch cluster - and all enrolled Elastic Agents. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kibana to the patched releases identified in ESA-2026-140: version 8.19.2, 9.4.6, or 9.5.3, per the advisory at https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-140/390158. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all users and service accounts holding Kibana Fleet management privileges and verify alignment with organizational role requirements. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today