CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

What is CVE-2026-78581?

CVE-2026-78581 is a medium-severity missing authorization vulnerability in Elastic Kibana, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.

Weakness: CWE-639

Which versions are affected by CVE-2026-78581?

2 open source packages ship an affected version, including kibana and elk. It affects 1 product.

Products include Elastic Kibana.

How do I fix CVE-2026-78581?

Upgrade kibana to a fixed version for your release line: 8.16.3 or 8.17.2.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-78581 being exploited?

There is no known exploitation of CVE-2026-78581 in the wild and no public exploit code.

Other vulnerabilities in Elastic Kibana

• CVE-2019-7609 Kibana Arbitrary Code Execution Exploited Critical 9.8
• CVE-2025-25015 Kibana arbitrary code execution via prototype pollution Critical 9.9
• CVE-2024-37288 Deserialization in Kibana Critical 9.9
• CVE-2023-31415 Code injection in Kibana Critical 9.9
• CVE-2018-17245 Information disclosure in Kibana Critical 9.8

All Elastic Kibana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-elk-2026-78581, BIT-kibana-2026-78581, GHSA-623v-mjrc-8wr7.