BIT-elk-2026-78593

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/elk/BIT-elk-2026-78593.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-elk-2026-78593
Aliases
Published
2026-09-09T08:41:44Z
Modified
2026-09-09T09:41:01Z
Summary
Improper Control of Generation of Code in Kibana Leading to Privilege Escalation
Details

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:elasticsearch:kibana:*:*:*:*:*:node.js:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / elk

Package

Name
elk
Purl
pkg:bitnami/elk

Severity

  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
8.0.0
Fixed
8.19.21
Introduced
9.0.0
Fixed
9.4.6
Introduced
9.5.0
Fixed
9.5.3

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/elk/BIT-elk-2026-78593.json"