Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.
Affected Versions:
- 7.x: All versions from 7.14.0 up to and including 7.17.29
- 8.x: All versions from 8.0.0 up to and including 8.19.20
- 9.x:
- All versions from 9.0.0 up to and including 9.4.5
- All versions from 9.5.0 up to and including 9.5.1
Affected Configurations:
Kibana deployments where APM server integrations are configured through Fleet using secret token authentication, or deployments using a cloud APM standalone setup with a secret token configured. Kibana deployments without Fleet-managed APM, or without secret token authentication configured, are not affected.
Solutions and Mitigations:
The issue is resolved in Kibana versions 8.19.21, 9.4.6, and 9.5.2. Elastic recommends rotating the APM secret token after upgrading.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Elastic Cloud Serverless is not affected by this vulnerability. Fleet-managed APM policies and cloud APM standalone configurations are not provisioned in the Serverless offering, so no credentials are reachable in that environment.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE ID: CVE-2026-78608
Problem Type: CWE-862 - Missing Authorization
Impact: CAPEC-122 - Privilege Abuse