CVE-2026-78581

Kibana versions prior to 5.2.1 configured for SSL client access do not clean up file descriptors after certain requests, leading to accumulation over time until the process crashes.

Kibana versions before 4.5.4 and 4.1.11, when a custom output is configured for logging, may write cookies and authorization headers to log files. This information could be used to hijack sessions of other users using Kibana behind some form of authentication such as Shield.

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an authenticated user holding only the Agent Builder read privilege can supply an identifier already in use by another user in the same space and cause that user's conversation to be replaced and reassigned to the requesting account. The original owner permanently loses access to the conversation and its history. The impact is limited to loss of integrity and availability of the affected conversation; the attacker does not read the overwritten content.

Kibana contains a Relative Path Traversal (CWE-23) vulnerability that can lead to unauthorized deletion of Kibana resources. Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored and later incorporated into the request when that configuration is removed.

Kibana contains a Missing Authorization (CWE-862) vulnerability that can lead to cross-space information disclosure and unauthorized data modification. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep ML data separated. Part of the ML functionality did not apply that filter, so operations from one space were carried out against ML data of every space.

Kibana has a resource allocation vulnerability (CWE-770) leading to denial of service via excessive allocation. A user-supplied list of document fields in the Playground for RAG feature is not bounded or de-duplicated before building responses. A single crafted request can make Kibana build a response far larger than the source data, exhausting instance resources.

Kibana has an incorrect authorization vulnerability (CWE-863) allowing unauthorized deletion of Synthetics private locations. Locations can be shared across spaces, and the deletion safeguard only checks monitors visible in the user's own space. An authenticated user with Synthetics write privilege in one space can delete a location that other spaces depend on, even without access to those spaces.

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the requesting user's account. Only Kibana feature privileges are verified, not the caller's Elasticsearch index privileges. An authenticated user with Elastic Security feature privileges but no read access to Elastic Defend event indices can retrieve field values, including process command line arguments, which commonly contain tokens, credentials, and other sensitive operational detail.

A Kibana Machine Learning capability that removes a saved object from the current space accepts trained models as a target, but only verifies privileges for anomaly detection and data frame analytics jobs. A user with those job creation privileges but without trained model privilege can remove a trained model from a space. The model is not deleted and remains in other spaces, and the change can be reversed by a privileged user.