EUVD-2026-69574
GHSA-hw7g-86hr-vpjv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Unauthorized creation of persistent Elasticsearch API keys constitutes an integrity violation (I:L) omitted from the vendor vector; all other metrics align with the description.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.
AnalysisAI
Kibana's Entity Store feature permits a low-privilege authenticated Security user to invoke an administrative initialization operation that creates and persists Elasticsearch API keys without holding the elevated cluster and Kibana privileges the documented setup flow mandates. The root cause is CWE-862 Missing Authorization - the endpoint does not verify the caller meets the required permission tier before executing the privileged action. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active, authenticated Kibana session scoped to at least low-privilege Security feature access - a standard user account assigned to the Kibana Security application suffices. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) captures network-accessible exploitation by an authenticated low-privilege user but assigns I:N, which understates real-world impact: unauthorized creation of persistent Elasticsearch API keys is an integrity violation - those credentials exist beyond the Kibana session and could be leveraged for direct Elasticsearch access that circumvents Kibana's access controls entirely. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kibana to version 8.19.21 (8.x) or 9.4.6 (9.x) per Elastic advisory ESA-2026-155 at https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-security-update-esa-2026-155/390072. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today