Kibana CVE-2026-78608

Exploitation requires a valid Kibana user account of any privilege level - a basic analyst or read-only role is sufficient. The target endpoint is an internal APM integration function within Kibana, so the Kibana instance must have the APM integration configured and APM server credentials stored. Exploitation is limited to authenticated sessions; unauthenticated external access is not possible based on the PR:L CVSS metric. Organizations where Kibana accounts are broadly distributed (e.g., developer or analyst populations) face the highest risk, as any of those users qualifies as an attacker. Non-APM Kibana deployments where no APM server credentials are stored would have no sensitive credential to expose.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-exploitable, low-complexity flaw requiring only a standard authenticated Kibana session - consistent with the description. The confidentiality impact is rated High because APM server credentials provide authenticated access to the APM backend and its telemetry data. There is no integrity or availability impact, and scope is unchanged. No EPSS score or KEV listing was provided, and no public exploit code is referenced, suggesting this is not under active mass exploitation at time of analysis. Real-world risk is moderate-to-significant: while exploitation requires a valid Kibana account, Kibana deployments commonly grant broad read access to analysts and developers who should not hold APM administrative credentials; any such user in a production environment - whether a large enterprise or a mid-sized municipal IT deployment - can silently harvest credentials usable for further access. The limiting factor is the mandatory authenticated session; organizations that tightly control Kibana account provisioning reduce their exposure considerably.

An analyst-role Kibana user authenticates to the Kibana web interface using their normal credentials and issues a direct HTTP request to the unguarded internal APM integration endpoint. The response returns the APM server credentials, which the attacker then uses to authenticate directly to the APM Server and access application performance telemetry, potentially including sensitive request traces, service topology, and environment variable data captured by APM agents. No exploit code is publicly referenced, but the attack requires no special tooling beyond an authenticated HTTP client.