CVE-2026-78603

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-78603
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78603.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-78603
Downstream
MINI (6)
Published
2026-09-01T19:20:35Z
Modified
2026-10-28T02:30:38Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata
Details

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.

Database specific 
{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78603.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "9.5.0"
                        },
                        {
                            "last_affected": "9.5.0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandaloneSingleVersion"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "9.0.0"
                        },
                        {
                            "last_affected": "9.4.5"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
112859b85d50de2a7e63f73c8fc70b99eea24291
Fixed
10011cbc74640115d0ffac0cef7c925aec4754f5
Introduced
8d4246a64bc255212407b1b313fe402391299c88
Last Affected
8d4246a64bc255212407b1b313fe402391299c88
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "9.0.0"
                },
                {
                    "fixed": "9.4.6"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:elastic:kibana:9.5.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "9.5.0"
                },
                {
                    "last_affected": "9.5.0"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

9.*
9.5.0
v9.*
v9.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78603.json"

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
504d6bfa94cca17fabb76e06152c30c4f0c3efdd
Fixed
692551ad493ed71169e295e2160446428ee00b15
Introduced
240f7d17d21408117f4295bcf74d48092ab0d078
Last Affected
240f7d17d21408117f4295bcf74d48092ab0d078
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "9.0.0"
                },
                {
                    "fixed": "9.4.6"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:elastic:kibana:9.5.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "9.5.0"
                },
                {
                    "last_affected": "9.5.0"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

9.*
9.5.0
v9.*
v9.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78603.json"