CVE-2026-78601 Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure
An authenticated user with elevated privileges can bypass authorization checks to expose data from unauthorized Elasticsearch indices via Kibana Entity Store.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-78601?
CVE-2026-78601 is a medium-severity missing authorization vulnerability in Elastic Kibana, published on 2 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.
Weakness: CWE-862
Which versions are affected by CVE-2026-78601?
It affects 1 product.
Products include Elastic Kibana.
How do I fix CVE-2026-78601?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-78601 being exploited?
There is no known exploitation of CVE-2026-78601 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-r3rh-pvj2-mrj8, MINI-mc4g-92vp-grcj.