Kibana EUVD-2026-69560

Exploitation requires a valid Kibana account with at least workflow edit permissions (confirmed by CVSS PR:L). The workflow scheduling feature must be enabled and accessible to the attacker's account. A higher-privileged user - such as an administrator or operator with broader data access - must be associated with workflows in the environment for the attacker to impersonate their execution context and gain meaningful privilege escalation. Once a malicious schedule is created, no further user interaction is required (UI:N); the scheduled trigger fires automatically. Limiting factors: the attacker must hold a legitimate Kibana account with workflow edit rights (not the lowest permission tier), and the environment must contain at least two users with differing privilege levels for the escalation to yield any additional access.

The CVSS 8.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) accurately reflects the core risk: the attack is network-accessible, requires no special deployment configuration, and demands only low-level authenticated access (workflow edit permission). C:H and I:H indicate an attacker can read sensitive data and tamper with data ordinarily protected from their account. A:L is incidental rather than primary. No CISA KEV listing and no publicly available exploit code reduce immediate mass-exploitation urgency; however, the attack pattern is conceptually straightforward - workflow permission abuse is accessible to any authenticated user who understands the scheduling feature. The CPE wildcard suggests a wide installed version range is exposed, amplifying population-level risk. Organizations running Kibana in multi-tenant or multi-role configurations (e.g., SOC analysts alongside administrators) face meaningfully elevated risk relative to single-role deployments. EPSS data is not provided in the available intelligence, so exploitation probability cannot be quantified independently.

An authenticated Kibana user with workflow edit permissions creates or modifies a scheduled workflow and manipulates the execution context to associate it with a higher-privileged user's identity - such as an administrator. When the schedule fires automatically, Kibana executes the workflow under that administrator's privileges, allowing the attacker to read sensitive Elasticsearch indices, dashboards, or configuration data, and write or delete records ordinarily protected from their own account. No public exploit code is known at time of analysis, but the attack requires only familiarity with Kibana's workflow scheduling interface.