CVE-2026-26939 Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration
Authenticated attackers with rule management privileges can bypass authorization to configure unauthorized endpoint response actions like host isolation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26939?
CVE-2026-26939 is a medium-severity missing authorization vulnerability in Elastic Kibana, published on 19 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
Weakness: CWE-862
Which versions are affected by CVE-2026-26939?
It affects 1 product.
Products include Elastic Kibana.
How do I fix CVE-2026-26939?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-26939 being exploited?
There is no known exploitation of CVE-2026-26939 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-x4hf-rw83-jxhf, MINI-4rcg-v2hf-95p6, MINI-69v5-p335-rg4v, MINI-6x7c-g79v-hh7g, MINI-h9pj-4qmc-7232, MINI-q7xg-gp5r-r2fg and 1 more.