CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Medium 4.3 Published 2 Sep 2026 Updated 2 Sep 2026

An authenticated user with Osquery privileges can determine if scheduled query IDs exist in unauthorized Kibana spaces, leading to information disclosure.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-78584?

CVE-2026-78584 is a medium-severity vulnerability in Elastic Kibana, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.

Weakness: CWE-204

Which versions are affected by CVE-2026-78584?

It affects 1 product.

Products include Elastic Kibana.

How do I fix CVE-2026-78584?

Apply the vendor's patch.

Is CVE-2026-78584 being exploited?

There is no known exploitation of CVE-2026-78584 in the wild and no public exploit code.

All Elastic Kibana vulnerabilities

Sources

Also known as GHSA-jvjr-rxxh-8cxq, MINI-3868-m69j-7cww.