EUVD-2026-69572
GHSA-r25h-rqj8-hg2m
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
AC:H reflects the prerequisite username collision across distinct realms; PR:L because valid credentials in one realm are required; C:L/I:L bounded to AI Assistant KB entries; A:N since entry deletion does not constitute systemic availability loss.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.
AnalysisAI
Incorrect Authorization in Kibana's Elastic AI Assistant Knowledge Base allows an authenticated user to read, modify, and delete private Knowledge Base entries belonging to a different user when both principals share an identical username value but originate from distinct authentication realms. Elastic advisory ESA-2026-142 confirms the flaw across multiple 8.x and 9.x release lines, with fixed versions 8.19.21, 9.4.6, and 9.5.2 released. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the Kibana deployment must be configured with two or more distinct, simultaneously active authentication realms (e.g., LDAP and SAML); (2) two separate principals across those realms must coincidentally or deliberately share an identical username string; (3) at least one of those principals must have private Elastic AI Assistant Knowledge Base entries. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, scoring 4.2) reflects the constrained nature of this flaw accurately: AC:H captures the required coincidence of an identical username existing across two separate authentication realms, and C:L/I:L reflects impact bounded to AI Assistant Knowledge Base entries rather than broader Kibana or Elasticsearch data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kibana to version 8.19.21, 9.4.6, or 9.5.2 as applicable, per Elastic advisory ESA-2026-142 at https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-142/390093. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today