CVE-2026-78597

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78597.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "last_affected": "8.19.20"
                },
                {
                    "introduced": "9.0.3"
                },
                {
                    "last_affected": "9.4.5"
                }
            ]
        }
    ],
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type

GIT

Repo

https://github.com/elastic/elasticsearch

Events

Introduced

1b6a7ece17463df5ff54a3e1302d825889aa1161

Fixed

4fe44c255c3d0da06779b921e132cdc555ed9aff

Introduced

cc7302afc8499e83262ba2ceaa96451681f0609d

Fixed

10011cbc74640115d0ffac0cef7c925aec4754f5

Database specific

Show details

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.19.21"
        },
        {
            "introduced": "9.0.3"
        },
        {
            "fixed": "9.4.6"
        }
    ]
}

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 922.0,
            "function_hash": "336576695806030868800945061847176163790"
        },
        "id": "CVE-2026-78597-591830c4",
        "target": {
            "function": "testFielddataLookupSometimesLoop",
            "file": "server/src/test/java/org/elasticsearch/index/query/SearchExecutionContextTests.java"
        },
        "source": "https://github.com/elastic/elasticsearch/commit/4fe44c255c3d0da06779b921e132cdc555ed9aff",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1732.0,
            "function_hash": "326805546120623397314007161934836214716"
        },
        "id": "CVE-2026-78597-59457f90",
        "target": {
            "function": "collect",
            "file": "server/src/test/java/org/elasticsearch/index/query/SearchExecutionContextTests.java"
        },
        "source": "https://github.com/elastic/elasticsearch/commit/4fe44c255c3d0da06779b921e132cdc555ed9aff",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "22835798154405399894246453021669004141",
                "29171084489851244844220596788322192731",
                "187376134121947755566998850598833240229",
                "106430991013007091138793583297008764703",
                "50570481815949601694422449651190546487",
                "201665032652128977888808665311154529076",
                "125855157464869141483767522307340749212",
                "297207686464565493924621741787098594650",
                "24411554321254736534444532478575654008",
                "97859342407569461889863357094260889363",
                "298503252520904896782764979792532010770",
                "76180966254630881114115693760540963633",
                "232019673834734648038931149403214905308",
                "53414536704182892388229572717968592140",
                "199860281037896650084911896177435445040",
                "196193423214693092074689371810076811286",
                "73179884562904000728331000468320402460",
                "11020444321161815997837746095771329417",
                "136388003720972492434355256785627729495",
                "230037432197204848111923845968903362181",
                "226434813611897875062739514910322770113",
                "105996862456501567444548530276239717134",
                "227535908976586554946792820757698460976"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-78597-7b444b14",
        "target": {
            "file": "server/src/test/java/org/elasticsearch/index/query/SearchExecutionContextTests.java"
        },
        "source": "https://github.com/elastic/elasticsearch/commit/4fe44c255c3d0da06779b921e132cdc555ed9aff",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78597.json"

vanir_signatures_modified

"2026-09-04T14:03:38Z"