CVE-2026-78608

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-78608
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78608.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-78608
Downstream
Published
2026-09-01T19:20:31.387Z
Modified
2026-09-04T14:06:35.286602Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Missing Authorization in Kibana Leading to Information Disclosure
Details

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78608.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "7.14.0"
                },
                {
                    "last_affected": "7.17.29"
                },
                {
                    "introduced": "8.0.0"
                },
                {
                    "last_affected": "8.19.20"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "last_affected": "9.4.5"
                },
                {
                    "introduced": "9.5.0"
                },
                {
                    "last_affected": "9.5.1"
                }
            ]
        }
    ],
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
dd5a0a2acaa2045ff9624f3729fc8a6f40835aa1
Last affected
580aff1a0064ce4c93293aaab6fcc55e22c10d1c
Introduced
1b6a7ece17463df5ff54a3e1302d825889aa1161
Fixed
4fe44c255c3d0da06779b921e132cdc555ed9aff
Introduced
112859b85d50de2a7e63f73c8fc70b99eea24291
Fixed
10011cbc74640115d0ffac0cef7c925aec4754f5
Introduced
8d4246a64bc255212407b1b313fe402391299c88
Fixed
b42549c72e6e040825b13e5d8ebf7ff63886b24d
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.14.0"
        },
        {
            "last_affected": "7.17.29"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.19.21"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.4.6"
        },
        {
            "introduced": "9.5.0"
        },
        {
            "fixed": "9.5.2"
        }
    ]
}

Affected versions

v9.*
v9.5.0
v9.5.1

Database specific

vanir_signatures 
[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "135052021381586703096475745787625846996",
                "165211593863699318769248196974601346783",
                "93283623091379418506488785897504512678",
                "26545141423582351670471289194004966592",
                "163657208054960210006054837373388252834",
                "188328033067523928975545214353316183280",
                "153861657743628462836102004850948745595",
                "282921420759628815169960595602566628382",
                "184573602202713091021972066972167860338",
                "29811076932042013910743558499223285624",
                "329060869068124202993854269015822909644",
                "208674098823385167178952187573268393324",
                "1790912059330226764817107183308278790",
                "250365171868249734159749096023348060987",
                "234287526282356732701761841793171567069",
                "198382026650527638707696153454227455590",
                "22314971617461182915801831963963349651",
                "248670988213692025743293766177521538469",
                "299527711206142555017430246441389624918",
                "314424171940312354540151943636534635821",
                "319894074297006831531250284074733644972",
                "300706329898922335316402366566757043028",
                "170031952266079495757137241821007859830",
                "49997997141269201607740040473519105167",
                "20985465904923486259211109010184634164",
                "242167330276683098608140382844566776966",
                "33950566296750829192802020892327850413",
                "176192876017832838873773101418201333563",
                "284423169205913515477596337728676329506",
                "20850313955169809489168194826791412330",
                "333903305963961335898124161710482880456",
                "271796563581059297781225176288220860800",
                "33208540788650055032930896198457671125",
                "282006514390693352268708910181525894168",
                "169451357934179425439211439538890303504",
                "278107203642233221015714977264129937095",
                "260053361466461183187753394988690923594",
                "165485295842040287002401864914731593811",
                "120069717387387360263135575602180210321"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-78608-3a7783ac",
        "target": {
            "file": "server/src/test/java/org/elasticsearch/index/codec/vectors/cluster/AbstractHierarchicalKMeansTestCase.java"
        },
        "source": "https://github.com/elastic/elasticsearch/commit/b42549c72e6e040825b13e5d8ebf7ff63886b24d",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 922.0,
            "function_hash": "336576695806030868800945061847176163790"
        },
        "id": "CVE-2026-78608-591830c4",
        "target": {
            "function": "testFielddataLookupSometimesLoop",
            "file": "server/src/test/java/org/elasticsearch/index/query/SearchExecutionContextTests.java"
        },
        "source": "https://github.com/elastic/elasticsearch/commit/4fe44c255c3d0da06779b921e132cdc555ed9aff",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1732.0,
            "function_hash": "326805546120623397314007161934836214716"
        },
        "id": "CVE-2026-78608-59457f90",
        "target": {
            "function": "collect",
            "file": "server/src/test/java/org/elasticsearch/index/query/SearchExecutionContextTests.java"
        },
        "source": "https://github.com/elastic/elasticsearch/commit/4fe44c255c3d0da06779b921e132cdc555ed9aff",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "22835798154405399894246453021669004141",
                "29171084489851244844220596788322192731",
                "187376134121947755566998850598833240229",
                "106430991013007091138793583297008764703",
                "50570481815949601694422449651190546487",
                "201665032652128977888808665311154529076",
                "125855157464869141483767522307340749212",
                "297207686464565493924621741787098594650",
                "24411554321254736534444532478575654008",
                "97859342407569461889863357094260889363",
                "298503252520904896782764979792532010770",
                "76180966254630881114115693760540963633",
                "232019673834734648038931149403214905308",
                "53414536704182892388229572717968592140",
                "199860281037896650084911896177435445040",
                "196193423214693092074689371810076811286",
                "73179884562904000728331000468320402460",
                "11020444321161815997837746095771329417",
                "136388003720972492434355256785627729495",
                "230037432197204848111923845968903362181",
                "226434813611897875062739514910322770113",
                "105996862456501567444548530276239717134",
                "227535908976586554946792820757698460976"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-78608-7b444b14",
        "target": {
            "file": "server/src/test/java/org/elasticsearch/index/query/SearchExecutionContextTests.java"
        },
        "source": "https://github.com/elastic/elasticsearch/commit/4fe44c255c3d0da06779b921e132cdc555ed9aff",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1318.0,
            "function_hash": "73696363205630521427229600524674962584"
        },
        "id": "CVE-2026-78608-dccf863f",
        "target": {
            "function": "testHKmeans",
            "file": "server/src/test/java/org/elasticsearch/index/codec/vectors/cluster/AbstractHierarchicalKMeansTestCase.java"
        },
        "source": "https://github.com/elastic/elasticsearch/commit/b42549c72e6e040825b13e5d8ebf7ff63886b24d",
        "signature_version": "v1"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78608.json"
vanir_signatures_modified 
"2026-09-04T14:06:35Z"

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
f032cf9bdbf6f74b70db5e43b7b1d30f5de22d3e
Last affected
f6e2f2e44cc0a6a11435f1b6350f735e23bef4b4
Introduced
240f7d17d21408117f4295bcf74d48092ab0d078
Fixed
37dc1e9d6dbf80bb1cf22da5ed258d3f642d2f9c
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.14.0"
        },
        {
            "last_affected": "7.17.29"
        },
        {
            "introduced": "9.5.0"
        },
        {
            "fixed": "9.5.2"
        }
    ]
}

Affected versions

v9.*
v9.5.0
v9.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78608.json"