What is the CVSS score of CVE-2026-78595?

CVE-2026-78595 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Kibana Fleet CVE-2026-78595

EUVD-2026-70659 MEDIUM

Missing Authorization (CWE-862)

2026-09-03 elastic

GHSA-xvx8-crx2-xjwv

Information Disclosure Elastic Kibana

4.3

CVSS 3.1 · Vendor: elastic

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to Kibana with low-privilege Fleet read role
Delivery

Identify Fleet API endpoint for agent listing
Exploit

Issue cross-space agent enumeration requests
Execution

Retrieve hostnames, IPs, and diagnostic metadata from other spaces
Impact

Use infrastructure details for lateral movement planning

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an authenticated Kibana user holding at minimum read-level Fleet agent privileges in any one Kibana space. The vulnerability only manifests in deployments where Kibana Spaces are used as a tenant-isolation mechanism and multiple spaces contain Fleet-enrolled agents. In single-space Kibana deployments, cross-space exposure is not applicable and this vulnerability has no practical impact. The attacker must have network access to the Kibana API. No special configuration, elevated OS privileges, or local access is needed beyond the low-level authenticated role. The limiting factor is the PR:L requirement - unauthenticated users cannot exploit this issue.
Impact	Real-world risk is moderate and contained. CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is technically accurate: network-exploitable, no special attack complexity, but requires authenticated access with at least read-level Fleet agent role in one space. No public exploit exists, no CISA KEV listing, and EPSS data is not provided. The primary business risk is multi-tenancy breach: in organizations that use Kibana spaces to separate teams (e.g., prod vs. dev, or separate business units), a low-privileged user in one space can silently enumerate agents, hostnames, IP addresses, and diagnostic artifacts belonging to other spaces - which may constitute sensitive infrastructure inventory. Integrity and availability are unaffected. The S:U (unchanged) scope metric is consistent with the impact being contained within Kibana's own data store. Prioritization is appropriate for environments actively using Kibana spaces for tenant isolation; lower urgency in single-space deployments.
Exploit ScenarioDerived	An authenticated analyst with read-level Fleet agent access in the 'team-a' Kibana space sends Fleet API requests to enumerate agent records. Despite being scoped to 'team-a', the missing authorization check returns agent metadata - hostnames, IP addresses, OS details, enrollment tokens - and diagnostic bundles from 'team-b' and 'team-c' spaces. No exploit code is publicly available; this is straightforward API abuse using existing credentials and standard HTTP clients.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 03, 2026

Cross-space agent data exposure in the Kibana Fleet feature allows authenticated low-privileged users to read agent metadata and diagnostic content outside their authorized Kibana space. An attacker holding read-level Fleet agent privileges in any one Kibana space can enumerate agents enrolled in other spaces - bypassing the space-based access boundary that Elastic uses for multi-tenancy isolation. No public exploit or active exploitation has been identified; CVSS 4.3 with PR:L aligns with the real-world impact: meaningful tenant boundary breach, but limited to read-only metadata disclosure.

RemediationAI

Upgrade Kibana to version 9.4.6 (stable) or 9.5.3 (latest) per the vendor advisory at https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160. These are the vendor-confirmed patched releases for ESA-2026-153. If immediate patching is not possible and tenant isolation between spaces is critical, consider restricting Fleet agent read privileges to only trusted, known-scope users as a short-term compensating control - note that this may impair legitimate Fleet monitoring workflows. Alternatively, collapsing multi-space deployments into a single space temporarily eliminates the cross-space boundary but sacrifices the isolation model entirely. There is no indication that disabling Fleet itself is a viable mitigation for most deployments. Review access logs for unusual Fleet API calls originating from users who operate in a different space than the agents being queried.

Affected VersionsENISA

Kibana 9.5.0 ≤9.5.2

Kibana 9.1.0 ≤9.4.5

Affected Packages

euvd kibana no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Kibana organizes resources into 'spaces' - logical partitions for multi-tenancy, enabling different teams to share a Kibana instance while seeing only their own dashboards, agents, and data. The Fleet feature manages Elastic Agents: enrolled endpoints that ship logs, metrics, and traces to the Elastic Stack. CWE-862 (Missing Authorization) indicates that the Fleet API endpoint responsible for returning agent metadata and diagnostic content performs authentication (verifying identity and checking for read-level Fleet privileges) but omits the authorization step that restricts those results to agents belonging to the caller's space. The root cause aligns with CAPEC-122 (Privilege Abuse): legitimate, granted privileges are exercised against resources they were never intended to cover. Affected CPE is cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* with the fix delivered in versions 9.4.6 and 9.5.3.

Know when Kibana gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (elastic) PRIMARY 4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI 4.3 MEDIUM

Network-accessible Kibana API; PR:L for required Fleet read role; C:L for cross-space metadata only; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

DescriptionCVE.org

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

High

Kibana is the dominant UI for Elastic Stack, widely deployed in enterprise observability

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +22

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.