EUVD-2026-70063
GHSA-jvjr-rxxh-8cxq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Kibana with Osquery live-query privilege
-
DeliveryEnumerate or guess scheduled query UUIDs
-
ExploitQuery identifiers across unauthorized space boundaries
-
ExecutionObserve distinguishable response discrepancy (CWE-204)
-
ImpactMap scheduled query IDs existing in restricted spaces
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Response uniformity
|
| Exploitation Conditions | Exploitation requires: (1) an authenticated Kibana session with the Osquery live-query privilege explicitly granted to the user role; (2) the Osquery feature enabled within the Kibana deployment; (3) the ability to reference or guess scheduled query identifiers from other Kibana spaces. The vulnerability does not expose query content, scheduled query configurations, or endpoint query results - only the existence of a scheduled query identifier in an unauthorized space. Users without the Osquery live-query privilege cannot exploit this issue, and the flaw does not affect Kibana deployments that do not use the Osquery feature. |
| Impact | CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is well-calibrated for this vulnerability: it requires a low-privilege authenticated session, has no integrity or availability impact, and exposes only metadata about query identifier existence rather than query content or endpoint data. No EPSS score is provided in the available intelligence, and the absence of a KEV listing or public exploit code further supports a low operational priority. The CPE wildcard indicates broad version exposure, but exploitation is bounded by the Osquery live-query privilege requirement, limiting the realistic attacker population to users who already have legitimate Kibana access. The impact is confined to cross-space ID enumeration - an attacker learns that a scheduled query identifier exists in another space, but gains no access to its configuration, results, or the underlying endpoint query data, making this difficult to chain to a higher-severity outcome without additional unrelated vulnerabilities. |
| Exploit ScenarioDerived | An authenticated Kibana user - for example, a Tier-1 analyst with Osquery live-query rights in their own space - iterates through known or guessed scheduled query UUID formats and submits queries that reference those identifiers against other Kibana spaces. By comparing API response codes or bodies, the analyst determines which scheduled query IDs exist in spaces they are not authorized to access, effectively mapping the endpoint query monitoring posture of other teams or tenants within the same Kibana deployment. No public exploit code is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Observable response discrepancy in Kibana's Osquery feature enables cross-space scheduled query ID enumeration by authenticated low-privileged users. An attacker holding Osquery live-query privileges can determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access by observing distinguishably different API responses. Vendor-released patch is version 9.4.4 per ESA-2026-161; no public exploit or CISA KEV listing is identified at time of analysis.
RemediationAI
Upgrade Kibana to version 9.4.4 or later as documented in Elastic's advisory ESA-2026-161 (https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-161/390115). As an interim compensating control, audit and restrict Osquery live-query privileges to only the users and service accounts that genuinely require them, reducing the population of principals capable of exploiting the response discrepancy. Disabling the Osquery feature entirely in Kibana spaces where it is not operationally required also eliminates exposure, though this will prevent legitimate endpoint security querying workflows in those spaces.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kibana's Osquery integration exposes a live-query API that interacts with Elastic's Osquery Manager for endpoint security querying. CWE-204 (Observable Response Discrepancy) arises when the server returns semantically distinct error codes or response structures for 'resource not found' versus 'access denied' conditions, allowing a caller to infer the existence of resources outside their authorization scope. The affected CPE (cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*) covers all Kibana versions prior to 9.4.4. This follows CAPEC-54 (Query System for Information), a reconnaissance technique where differential responses leak presence/absence information. The attack surface is the Kibana API layer, accessible over the network to any authenticated user with the Osquery live-query privilege.
Know when Kibana gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible API, low-privilege auth required, scope unchanged, only limited confidentiality impact (existence of query ID, no content or endpoint data).
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
DescriptionCVE.org
Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Authorization bypass in Kibana's Fleet package installation process lets an authenticated user who holds delegated Fleet
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Exploit-DB