Kibana CVE-2026-82299

Exploitation requires a valid, low-privilege authenticated Kibana session (PR:L per CVSS vector). The vulnerability is network-accessible (AV:N) with no user interaction required (UI:N) and low attack complexity (AC:L), meaning no special race condition or unusual configuration is needed beyond possessing a Kibana account. Exploitation is limited by the authentication prerequisite - unauthenticated external attackers cannot exploit this directly. Organizations with no external Kibana exposure and strictly controlled account provisioning face significantly lower practical risk than those with multi-tenant deployments or broadly issued credentials.

The CVSS 3.1 score of 6.5 (Medium) reflects network-accessible exploitation at low complexity requiring only low-privilege authentication, with high confidentiality impact and no integrity or availability consequence. This is a realistic, actionable risk profile: an adversary with any valid Kibana account could exfiltrate data they are not authorized to see. No KEV listing exists and no POC has been publicly identified, so mass automated exploitation is not currently observed - EPSS data was not supplied, so exploitation probability cannot be quantified from that signal. The 'Authentication Bypass' tag in the input metadata is misleading: this flaw requires a valid authenticated session (PR:L), meaning it bypasses authorization checks post-authentication, not authentication itself. Real-world risk is moderate-to-high for organizations with multi-tenant Kibana deployments or role-based data access policies, where the authorization gap could expose sensitive index data, dashboards, or configurations to lower-privileged users or service accounts.

An attacker with a low-privilege Kibana account - such as a read-only analyst or service account - crafts a request to an endpoint or resource path that the authorization logic fails to correctly gate. The request succeeds, returning data (index contents, saved objects, or configuration) that the account's role should not permit access to. No special tooling is required; standard HTTP requests to the Kibana API would be sufficient if the authorization check gap is in a predictable endpoint.